I would assume that freemember is either pulling in values from the form using the unclean
$_POST array or using
ee()->input->post('var_name'); (note the lack of second security parameter which should be
true). I suspect the former as using the EE function (on latest 2.10.1) I beleive still strips dangerous script tags regardless of the XSS_Clean parameter.
Because of the lack of detail here I can only surmise, however I would take a look through the modules code, identify where it gets the posted values and change the method of retrieval to
This should then parse and clean the posts.
Another alternative is that you've changede the XSS Cleaning setting (in
Admin > Security) to no or off. Please review this setting.
If I where you I'd submit this as a bug on freemember if your security settings are correct but it's still defeating them, the module is by DevDemon so you can submit an issue here
Lastly, you have set an encryption key on freemember, right?? Docs