diff --git a/includes/Admin/FormPreview.php b/includes/Admin/FormPreview.php
index 964ecdf..c3effc7 100644
--- a/includes/Admin/FormPreview.php
+++ b/includes/Admin/FormPreview.php
@@ -33,6 +33,12 @@ public function __construct() {
      * @return string
      */
     public function render_form_component() {
+        if ( ! wemail()->user->can( 'view_form' ) ) {
+            wp_die( esc_html__( 'You do not have permission to access this page.', 'wemail' ), 403 );
+        }
+
+        check_ajax_referer( 'wemail_form_preview', 'nonce' );
+
         global $wp_scripts;
         $form = wemail_form( $this->form_id, true );
         ?>
@@ -52,7 +58,7 @@ public function render_form_component() {
             </head>
             <body>
                 <div>
-                    <?php printf( '<div id="preview-wemail-form" data-form-type="%s"><wemail-form-preview id="%s"/></div>', $form['type'], $this->form_id ); ?>
+                    <?php printf( '<div id="preview-wemail-form" data-form-type="%s"><wemail-form-preview id="%s"/></div>', esc_attr( $form['type'] ), esc_attr( $this->form_id ) ); ?>
                 </div>
 
                 <script src="<?php /** phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript */ echo get_site_url() . $wp_scripts->registered['jquery-core']->src; ?>"></script>
diff --git a/includes/Admin/GutenbergBlock.php b/includes/Admin/GutenbergBlock.php
index f70d9fa..3378f05 100644
--- a/includes/Admin/GutenbergBlock.php
+++ b/includes/Admin/GutenbergBlock.php
@@ -41,8 +41,9 @@ public function export_forms() {
             'wemail-block-script',
             'weMailData',
             array(
-                'forms'  => $forms ? $forms : array(),
+                'forms'   => $forms ? $forms : array(),
                 'siteUrl' => get_site_url(),
+                'previewNonce' => wp_create_nonce( 'wemail_form_preview' ),
             )
         );
     }
diff --git a/src/blocks/wemail-form/index.js b/src/blocks/wemail-form/index.js
index ebe8c92..c8c785c 100644
--- a/src/blocks/wemail-form/index.js
+++ b/src/blocks/wemail-form/index.js
@@ -59,7 +59,7 @@ registerBlockType('wemail/forms', {
                 <div height="500px" className="wemail-block-form-preview">
                     <div className="wemail-block-overlay"/>
                     <iframe className={props.attributes.isLoading ? 'hide' : ''} onLoad={loadForm} width="100%"
-                            src={`${window.weMailData.siteUrl}/wp-admin/admin-ajax.php?action=wemail_preview&form_id=${encodeURIComponent(formId)}`}
+                            src={`${window.weMailData.siteUrl}/wp-admin/admin-ajax.php?action=wemail_preview&form_id=${encodeURIComponent(formId)}&nonce=${encodeURIComponent(window.weMailData.previewNonce)}`}
                             frameBorder="0" scrolling="no"/>
                     {
                         props.attributes.isLoading ?
