WP Quick FrontEnd Editor <= 5.5 - Authenticated Content Injection

The AJAX action save_content_front lack any capability and CSRF checks, allowing low privilege users to modify any page or post from the blog. This could also lead to XSS via a CSRF attack on a logged in high privilege user.