Lack of authorisation checks in the twoj_slideshow_setup() function registered as an AJAX call could allow authenticated users with low privileges to deactivate arbitrary plugins.
Jerome Bruandet (nintechnet.com)
No
2020-01-20 (about 3 years ago)
2020-01-20 (about 3 years ago)
2020-01-21 (about 3 years ago)