I know ways to solve this if I had control of the core code. I might open a channel of communication between the iframe and the parent similar to Web Workers, using the postMessage api. For my plugin it would send some kind of querySelector message (text) and get a deserializable json array back of matched html (text). Or alternately, with my particular plugin a count of matches would work.
The point is providing the communications channel would make it possible for embedded, isolated plugins to interact with the core app in a controlled, sandbox fashion. Then the core could decide what kinds of messages it responds to. I offered 1 or 2 as an example.