CVE-2025-32426: Formie has XSS vulnerability for email notification content for preview

The vulnerability description states that it's possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. The provided commit information for 13bb967277f1b9f59dc0024e9e717795a250b805 shows a change in src/controllers/EmailController.php. Specifically, in the actionPreview method, the line 'body' => $email->getHtmlBody() was changed to 'body' => StringHelper::cleanString($email->getHtmlBody()). This indicates that the actionPreview method was previously rendering raw HTML obtained from $email->getHtmlBody() and was vulnerable to XSS. The getHtmlBody() method itself is the source of the potentially malicious content. The fix involves sanitizing this content using StringHelper::cleanString before it's used.