In PlUploadFile::preRenderPlUploadFile(), the plupload url token is generated using the path "plupload-handle-uploads". This assumes the route has no been altered to another path.
D8 core already calculates the token when "_csrf" is set on the route.
See
https://www.drupal.org/docs/8/api/routing-system/access-checking-on-rout... →
Needs work
2.1
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.