[derpenxyne]

The exploit uses a "data-uri script tag" in the video embed field. In other words, it runs some sort of script through the section of the site that's supposed to only allow video embed codes from sites like YouTube and Vimeo. A pretty serious security hole.

[matthuggins]

Mind sharing where you found this info? Did you figure it out yourself?

[schill]

See point #10 from http://www.buzzfeed.com/ryanhatesthis/hacker-group-exploits-...