Fruitful < 3.8.2 - Authenticated Stored XSS & Theme Options Deletion

Description

The lack of capability and nonce checks in the fruitful_data_save ajax call could allow attacker to perform stored XSS attack using a low privilege account.

"Three other AJAX actions that should be accessible to the administrator only are accessible to any authenticated users:

fruitful_reset_btn: this action will delete the theme options.
fruitful_add_new_slide_action: this action only adds one or more input fields while editing the theme. No damage can be done to the website though.
run_import_dummy_data: this action will throw a fatal error because it attempts to call another function that does not exist."