XSS worm on my InfinityFree site?

I believe there’s a miscommunication. The youtube embed is done with an iframe embed. The fetching is done by a web browser to a 3rd party site namely youtube.com. Youtube is not fetching any data from my web site.