Formidable Form Builder < 2.05.03 - Reflected Cross-Site Scripting

The Formidable Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'before_html' parameter passed through the frm_forms_preview AJAX action in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser whenever they successfully trick a victim into performing an action like clicking on a link.