v0.24.2

• Security (WordPress.org directory review, round T2): the per-user "All tags" list filters that persist across page loads — usage bucket (WPTO_Admin_Page::get_active_bucket()), "Hide locked tags" (get_hide_locked_tags()), and quick-sort order (WPTO_Tag_Stats_Table::prepare_items()) — now write to user meta only after WPTO_Admin_Page::can_persist_filter_pref() passes, which checks current_user_can( 'manage_options' ) and a wpto_filter_prefs nonce. The histogram bars, quick-sort buttons, "Clear filter" links, and the hide-locked / tags-filter <form method="get"> now carry that nonce via wp_nonce_url() / wp_nonce_field(). A request without a valid nonce still has its filter applied to the current view but no longer alters another logged-in user's saved preferences (CSRF). The reviewer flagged only get_active_bucket(); the sibling cases were fixed in the same pass.

For the full version history, see CHANGELOG.md.