Threats tagged 'ghsa-5vf5-jrp9-rv6g'

The WP Photo Album Plus WordPress plugin versions before 9.3.04.004 contain a vulnerability where the plugin does not verify the origin or a security token for a comment-management request. This flaw allows attackers to delete photo comments by tricking a logged-in user with comment-moderation rights into loading a crafted page.