Threats tagged 'ghsa-cr4r-w36f-j7h9'

The Media Library Assistant WordPress plugin versions before 3.42 have a vulnerability where the Empty Trash media action does not verify a CSRF nonce. This allows a cross-site request forgery attack to cause a logged-in user with Editor role or higher to permanently delete all trashed media attachments on the site.