diff --git a/wp-admin/about.php b/wp-admin/about.php
index 8ad181f2b8..039e8474b4 100644
--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -42,7 +42,27 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 </h2>
 
 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 37 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 38 ); ?></h3>
+	<p>
+		<?php
+		printf(
+			/* translators: %s: WordPress version number */
+			__( '<strong>Version %s</strong> addressed one security issue.' ),
+			'4.1.38'
+		);
+		?>
+		<?php
+		printf(
+			/* translators: %s: HelpHub URL */
+			__( 'For more information, see <a href="%s">the release notes</a>.' ),
+			sprintf(
+				/* translators: %s: WordPress version */
+				esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+				sanitize_title( '4.1.38' )
+			)
+		);
+		?>
+	</p>
 	<p>
 		<?php
 		printf(
diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index 21dc7f3524..ac889a0fba 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -2011,6 +2011,10 @@ function wp_ajax_set_attachment_thumbnail() {
 		wp_send_json_error();
 	}
 
+	if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+		wp_send_json_error();
+	}
+
 	$post_ids = array();
 	// For each URL, try to find its corresponding post ID.
 	foreach ( $_POST['urls'] as $url ) {
diff --git a/wp-includes/js/media-audiovideo.js b/wp-includes/js/media-audiovideo.js
index 6119ad9d76..e90299447f 100644
--- a/wp-includes/js/media-audiovideo.js
+++ b/wp-includes/js/media-audiovideo.js
@@ -588,6 +588,7 @@
 
 				wp.ajax.send( 'set-attachment-thumbnail', {
 					data : {
+						_ajax_nonce: wp.media.view.settings.nonce.setAttachmentThumbnail,
 						urls: urls,
 						thumbnail_id: attachment.get( 'id' )
 					}
diff --git a/wp-includes/js/media-audiovideo.min.js b/wp-includes/js/media-audiovideo.min.js
index de5d61469e..a55b344c0b 100644
--- a/wp-includes/js/media-audiovideo.min.js
+++ b/wp-includes/js/media-audiovideo.min.js
@@ -1 +1 @@
-!function(i,s,e){var o=wp.media,t={},a="undefined"==typeof _wpMediaViewsL10n?{}:_wpMediaViewsL10n;s.isUndefined(window._wpmejsSettings)||(t=_wpmejsSettings),wp.media.mixin={mejsSettings:t,removeAllPlayers:function(){if(window.mejs&&window.mejs.players)for(var e in window.mejs.players)window.mejs.players[e].pause(),this.removePlayer(window.mejs.players[e])},removePlayer:function(e){var t,i;if(e.options){for(t in e.options.features)if(e["clean"+(i=e.options.features[t])])try{e["clean"+i](e)}catch(e){}e.isDynamic||e.$node.remove(),"native"!==e.media.pluginType&&e.$media.remove(),delete window.mejs.players[e.id],e.container.remove(),e.globalUnbind(),delete e.node.player}},unsetPlayers:function(){this.players&&this.players.length&&(s.each(this.players,function(e){e.pause(),wp.media.mixin.removePlayer(e)}),this.players=[])}},wp.media.playlist=new wp.media.collection({tag:"playlist",editTitle:a.editPlaylistTitle,defaults:{id:wp.media.view.settings.post.id,style:"light",tracklist:!0,tracknumbers:!0,images:!0,artists:!0,type:"audio"}}),wp.media.audio={coerce:wp.media.coerce,defaults:{id:wp.media.view.settings.post.id,src:"",loop:!1,autoplay:!1,preload:"none",width:400},edit:function(e){e=wp.shortcode.next("audio",e).shortcode;return wp.media({frame:"audio",state:"audio-details",metadata:s.defaults(e.attrs.named,this.defaults)})},shortcode:function(i){var e,a=this;return s.each(this.defaults,function(e,t){i[t]=a.coerce(i,t),e===i[t]&&delete i[t]}),e=i.content,delete i.content,new wp.shortcode({tag:"audio",attrs:i,content:e})}},wp.media.video={coerce:wp.media.coerce,defaults:{id:wp.media.view.settings.post.id,src:"",poster:"",loop:!1,autoplay:!1,preload:"metadata",content:"",width:640,height:360},edit:function(e){var t=wp.shortcode.next("video",e).shortcode,e=t.attrs.named;return e.content=t.content,wp.media({frame:"video",state:"video-details",metadata:s.defaults(e,this.defaults)})},shortcode:function(i){var e,a=this;return s.each(this.defaults,function(e,t){i[t]=a.coerce(i,t),e===i[t]&&delete i[t]}),e=i.content,delete i.content,new wp.shortcode({tag:"video",attrs:i,content:e})}},o.model.PostMedia=e.Model.extend({initialize:function(){this.attachment=!1},setSource:function(e){this.attachment=e,this.extension=e.get("filename").split(".").pop(),this.get("src")&&this.extension===this.get("src").split(".").pop()&&this.unset("src"),s.contains(wp.media.view.settings.embedExts,this.extension)?this.set(this.extension,this.attachment.get("url")):this.unset(this.extension)},changeAttachment:function(e){var t=this;this.setSource(e),this.unset("src"),s.each(s.without(wp.media.view.settings.embedExts,this.extension),function(e){t.unset(e)})}}),o.controller.AudioDetails=o.controller.State.extend({defaults:{id:"audio-details",toolbar:"audio-details",title:a.audioDetailsTitle,content:"audio-details",menu:"audio-details",router:!1,priority:60},initialize:function(e){this.media=e.media,o.controller.State.prototype.initialize.apply(this,arguments)}}),o.controller.VideoDetails=o.controller.State.extend({defaults:{id:"video-details",toolbar:"video-details",title:a.videoDetailsTitle,content:"video-details",menu:"video-details",router:!1,priority:60},initialize:function(e){this.media=e.media,o.controller.State.prototype.initialize.apply(this,arguments)}}),o.view.MediaFrame.MediaDetails=o.view.MediaFrame.Select.extend({defaults:{id:"media",url:"",menu:"media-details",content:"media-details",toolbar:"media-details",type:"link",priority:120},initialize:function(e){this.DetailsView=e.DetailsView,this.cancelText=e.cancelText,this.addText=e.addText,this.media=new o.model.PostMedia(e.metadata),this.options.selection=new o.model.Selection(this.media.attachment,{multiple:!1}),o.view.MediaFrame.Select.prototype.initialize.apply(this,arguments)},bindHandlers:function(){var e=this.defaults.menu;o.view.MediaFrame.Select.prototype.bindHandlers.apply(this,arguments),this.on("menu:create:"+e,this.createMenu,this),this.on("content:render:"+e,this.renderDetailsContent,this),this.on("menu:render:"+e,this.renderMenu,this),this.on("toolbar:render:"+e,this.renderDetailsToolbar,this)},renderDetailsContent:function(){var e=new this.DetailsView({controller:this,model:this.state().media,attachment:this.state().media.attachment}).render();this.content.set(e)},renderMenu:function(e){var t=this.lastState(),i=t&&t.id,a=this;e.set({cancel:{text:this.cancelText,priority:20,click:function(){i?a.setState(i):a.close()}},separateCancel:new o.View({className:"separator",priority:40})})},setPrimaryButton:function(e,t){this.toolbar.set(new o.view.Toolbar({controller:this,items:{button:{style:"primary",text:e,priority:80,click:function(){var e=this.controller;t.call(this,e,e.state()),e.setState(e.options.state),e.reset()}}}}))},renderDetailsToolbar:function(){this.setPrimaryButton(a.update,function(e,t){e.close(),t.trigger("update",e.media.toJSON())})},renderReplaceToolbar:function(){this.setPrimaryButton(a.replace,function(e,t){var i=t.get("selection").single();e.media.changeAttachment(i),t.trigger("replace",e.media.toJSON())})},renderAddSourceToolbar:function(){this.setPrimaryButton(this.addText,function(e,t){var i=t.get("selection").single();e.media.setSource(i),t.trigger("add-source",e.media.toJSON())})}}),o.view.MediaFrame.AudioDetails=o.view.MediaFrame.MediaDetails.extend({defaults:{id:"audio",url:"",menu:"audio-details",content:"audio-details",toolbar:"audio-details",type:"link",title:a.audioDetailsTitle,priority:120},initialize:function(e){e.DetailsView=o.view.AudioDetails,e.cancelText=a.audioDetailsCancel,e.addText=a.audioAddSourceTitle,o.view.MediaFrame.MediaDetails.prototype.initialize.call(this,e)},bindHandlers:function(){o.view.MediaFrame.MediaDetails.prototype.bindHandlers.apply(this,arguments),this.on("toolbar:render:replace-audio",this.renderReplaceToolbar,this),this.on("toolbar:render:add-audio-source",this.renderAddSourceToolbar,this)},createStates:function(){this.states.add([new o.controller.AudioDetails({media:this.media}),new o.controller.MediaLibrary({type:"audio",id:"replace-audio",title:a.audioReplaceTitle,toolbar:"replace-audio",media:this.media,menu:"audio-details"}),new o.controller.MediaLibrary({type:"audio",id:"add-audio-source",title:a.audioAddSourceTitle,toolbar:"add-audio-source",media:this.media,menu:!1})])}}),o.view.MediaFrame.VideoDetails=o.view.MediaFrame.MediaDetails.extend({defaults:{id:"video",url:"",menu:"video-details",content:"video-details",toolbar:"video-details",type:"link",title:a.videoDetailsTitle,priority:120},initialize:function(e){e.DetailsView=o.view.VideoDetails,e.cancelText=a.videoDetailsCancel,e.addText=a.videoAddSourceTitle,o.view.MediaFrame.MediaDetails.prototype.initialize.call(this,e)},bindHandlers:function(){o.view.MediaFrame.MediaDetails.prototype.bindHandlers.apply(this,arguments),this.on("toolbar:render:replace-video",this.renderReplaceToolbar,this),this.on("toolbar:render:add-video-source",this.renderAddSourceToolbar,this),this.on("toolbar:render:select-poster-image",this.renderSelectPosterImageToolbar,this),this.on("toolbar:render:add-track",this.renderAddTrackToolbar,this)},createStates:function(){this.states.add([new o.controller.VideoDetails({media:this.media}),new o.controller.MediaLibrary({type:"video",id:"replace-video",title:a.videoReplaceTitle,toolbar:"replace-video",media:this.media,menu:"video-details"}),new o.controller.MediaLibrary({type:"video",id:"add-video-source",title:a.videoAddSourceTitle,toolbar:"add-video-source",media:this.media,menu:!1}),new o.controller.MediaLibrary({type:"image",id:"select-poster-image",title:a.videoSelectPosterImageTitle,toolbar:"select-poster-image",media:this.media,menu:"video-details"}),new o.controller.MediaLibrary({type:"text",id:"add-track",title:a.videoAddTrackTitle,toolbar:"add-track",media:this.media,menu:"video-details"})])},renderSelectPosterImageToolbar:function(){this.setPrimaryButton(a.videoSelectPosterImageTitle,function(t,e){var i=[],a=e.get("selection").single();t.media.set("poster",a.get("url")),e.trigger("set-poster-image",t.media.toJSON()),s.each(wp.media.view.settings.embedExts,function(e){t.media.get(e)&&i.push(t.media.get(e))}),wp.ajax.send("set-attachment-thumbnail",{data:{urls:i,thumbnail_id:a.get("id")}})})},renderAddTrackToolbar:function(){this.setPrimaryButton(a.videoAddTrackTitle,function(e,t){var i=t.get("selection").single(),a=e.media.get("content");-1===a.indexOf(i.get("url"))&&(a+=['<track srclang="en" label="English"kind="subtitles" src="',i.get("url"),'" />'].join(""),e.media.set("content",a)),t.trigger("add-track",e.media.toJSON())})}}),o.view.MediaDetails=o.view.Settings.AttachmentDisplay.extend({initialize:function(){s.bindAll(this,"success"),this.players=[],this.listenTo(this.controller,"close",o.mixin.unsetPlayers),this.on("ready",this.setPlayer),this.on("media:setting:remove",o.mixin.unsetPlayers,this),this.on("media:setting:remove",this.render),this.on("media:setting:remove",this.setPlayer),this.events=s.extend(this.events,{"click .remove-setting":"removeSetting","change .content-track":"setTracks","click .remove-track":"setTracks","click .add-media-source":"addSource"}),o.view.Settings.AttachmentDisplay.prototype.initialize.apply(this,arguments)},prepare:function(){return s.defaults({model:this.model.toJSON()},this.options)},removeSetting:function(e){var t=i(e.currentTarget).parent(),e=t.find("input").data("setting");e&&(this.model.unset(e),this.trigger("media:setting:remove",this)),t.remove()},setTracks:function(){var t="";s.each(this.$(".content-track"),function(e){t+=i(e).val()}),this.model.set("content",t),this.trigger("media:setting:remove",this)},addSource:function(e){this.controller.lastMime=i(e.currentTarget).data("mime"),this.controller.setState("add-"+this.controller.defaults.id+"-source")},setPlayer:function(){!this.players.length&&this.media&&this.players.push(new MediaElementPlayer(this.media,this.settings))},setMedia:function(){return this},success:function(e){var t=e.attributes.autoplay&&"false"!==e.attributes.autoplay;"flash"===e.pluginType&&t&&e.addEventListener("canplay",function(){e.play()},!1),this.mejs=e},render:function(){var e=this;return o.view.Settings.AttachmentDisplay.prototype.render.apply(this,arguments),setTimeout(function(){e.resetFocus()},10),this.settings=s.defaults({success:this.success},t),this.setMedia()},resetFocus:function(){this.$(".embed-media-settings").scrollTop(0)}},{instances:0,prepareSrc:function(e){var t=o.view.MediaDetails.instances++;return s.each(i(e).find("source"),function(e){e.src=[e.src,-1<e.src.indexOf("?")?"&":"?","_=",t].join("")}),e}}),o.view.AudioDetails=o.view.MediaDetails.extend({className:"audio-details",template:o.template("audio-details"),setMedia:function(){var e=this.$(".wp-audio-shortcode");return e.find("source").length?(e.is(":hidden")&&e.show(),this.media=o.view.MediaDetails.prepareSrc(e.get(0))):(e.hide(),this.media=!1),this}}),o.view.VideoDetails=o.view.MediaDetails.extend({className:"video-details",template:o.template("video-details"),setMedia:function(){var e=this.$(".wp-video-shortcode");return e.find("source").length?(e.is(":hidden")&&e.show(),e.hasClass("youtube-video")?this.media=e.get(0):this.media=o.view.MediaDetails.prepareSrc(e.get(0))):(e.hide(),this.media=!1),this}})}(jQuery,_,Backbone);
\ No newline at end of file
+!function(i,s,e){var o=wp.media,t={},a="undefined"==typeof _wpMediaViewsL10n?{}:_wpMediaViewsL10n;s.isUndefined(window._wpmejsSettings)||(t=_wpmejsSettings),wp.media.mixin={mejsSettings:t,removeAllPlayers:function(){if(window.mejs&&window.mejs.players)for(var e in window.mejs.players)window.mejs.players[e].pause(),this.removePlayer(window.mejs.players[e])},removePlayer:function(e){var t,i;if(e.options){for(t in e.options.features)if(e["clean"+(i=e.options.features[t])])try{e["clean"+i](e)}catch(e){}e.isDynamic||e.$node.remove(),"native"!==e.media.pluginType&&e.$media.remove(),delete window.mejs.players[e.id],e.container.remove(),e.globalUnbind(),delete e.node.player}},unsetPlayers:function(){this.players&&this.players.length&&(s.each(this.players,function(e){e.pause(),wp.media.mixin.removePlayer(e)}),this.players=[])}},wp.media.playlist=new wp.media.collection({tag:"playlist",editTitle:a.editPlaylistTitle,defaults:{id:wp.media.view.settings.post.id,style:"light",tracklist:!0,tracknumbers:!0,images:!0,artists:!0,type:"audio"}}),wp.media.audio={coerce:wp.media.coerce,defaults:{id:wp.media.view.settings.post.id,src:"",loop:!1,autoplay:!1,preload:"none",width:400},edit:function(e){e=wp.shortcode.next("audio",e).shortcode;return wp.media({frame:"audio",state:"audio-details",metadata:s.defaults(e.attrs.named,this.defaults)})},shortcode:function(i){var e,a=this;return s.each(this.defaults,function(e,t){i[t]=a.coerce(i,t),e===i[t]&&delete i[t]}),e=i.content,delete i.content,new wp.shortcode({tag:"audio",attrs:i,content:e})}},wp.media.video={coerce:wp.media.coerce,defaults:{id:wp.media.view.settings.post.id,src:"",poster:"",loop:!1,autoplay:!1,preload:"metadata",content:"",width:640,height:360},edit:function(e){var t=wp.shortcode.next("video",e).shortcode,e=t.attrs.named;return e.content=t.content,wp.media({frame:"video",state:"video-details",metadata:s.defaults(e,this.defaults)})},shortcode:function(i){var e,a=this;return s.each(this.defaults,function(e,t){i[t]=a.coerce(i,t),e===i[t]&&delete i[t]}),e=i.content,delete i.content,new wp.shortcode({tag:"video",attrs:i,content:e})}},o.model.PostMedia=e.Model.extend({initialize:function(){this.attachment=!1},setSource:function(e){this.attachment=e,this.extension=e.get("filename").split(".").pop(),this.get("src")&&this.extension===this.get("src").split(".").pop()&&this.unset("src"),s.contains(wp.media.view.settings.embedExts,this.extension)?this.set(this.extension,this.attachment.get("url")):this.unset(this.extension)},changeAttachment:function(e){var t=this;this.setSource(e),this.unset("src"),s.each(s.without(wp.media.view.settings.embedExts,this.extension),function(e){t.unset(e)})}}),o.controller.AudioDetails=o.controller.State.extend({defaults:{id:"audio-details",toolbar:"audio-details",title:a.audioDetailsTitle,content:"audio-details",menu:"audio-details",router:!1,priority:60},initialize:function(e){this.media=e.media,o.controller.State.prototype.initialize.apply(this,arguments)}}),o.controller.VideoDetails=o.controller.State.extend({defaults:{id:"video-details",toolbar:"video-details",title:a.videoDetailsTitle,content:"video-details",menu:"video-details",router:!1,priority:60},initialize:function(e){this.media=e.media,o.controller.State.prototype.initialize.apply(this,arguments)}}),o.view.MediaFrame.MediaDetails=o.view.MediaFrame.Select.extend({defaults:{id:"media",url:"",menu:"media-details",content:"media-details",toolbar:"media-details",type:"link",priority:120},initialize:function(e){this.DetailsView=e.DetailsView,this.cancelText=e.cancelText,this.addText=e.addText,this.media=new o.model.PostMedia(e.metadata),this.options.selection=new o.model.Selection(this.media.attachment,{multiple:!1}),o.view.MediaFrame.Select.prototype.initialize.apply(this,arguments)},bindHandlers:function(){var e=this.defaults.menu;o.view.MediaFrame.Select.prototype.bindHandlers.apply(this,arguments),this.on("menu:create:"+e,this.createMenu,this),this.on("content:render:"+e,this.renderDetailsContent,this),this.on("menu:render:"+e,this.renderMenu,this),this.on("toolbar:render:"+e,this.renderDetailsToolbar,this)},renderDetailsContent:function(){var e=new this.DetailsView({controller:this,model:this.state().media,attachment:this.state().media.attachment}).render();this.content.set(e)},renderMenu:function(e){var t=this.lastState(),i=t&&t.id,a=this;e.set({cancel:{text:this.cancelText,priority:20,click:function(){i?a.setState(i):a.close()}},separateCancel:new o.View({className:"separator",priority:40})})},setPrimaryButton:function(e,t){this.toolbar.set(new o.view.Toolbar({controller:this,items:{button:{style:"primary",text:e,priority:80,click:function(){var e=this.controller;t.call(this,e,e.state()),e.setState(e.options.state),e.reset()}}}}))},renderDetailsToolbar:function(){this.setPrimaryButton(a.update,function(e,t){e.close(),t.trigger("update",e.media.toJSON())})},renderReplaceToolbar:function(){this.setPrimaryButton(a.replace,function(e,t){var i=t.get("selection").single();e.media.changeAttachment(i),t.trigger("replace",e.media.toJSON())})},renderAddSourceToolbar:function(){this.setPrimaryButton(this.addText,function(e,t){var i=t.get("selection").single();e.media.setSource(i),t.trigger("add-source",e.media.toJSON())})}}),o.view.MediaFrame.AudioDetails=o.view.MediaFrame.MediaDetails.extend({defaults:{id:"audio",url:"",menu:"audio-details",content:"audio-details",toolbar:"audio-details",type:"link",title:a.audioDetailsTitle,priority:120},initialize:function(e){e.DetailsView=o.view.AudioDetails,e.cancelText=a.audioDetailsCancel,e.addText=a.audioAddSourceTitle,o.view.MediaFrame.MediaDetails.prototype.initialize.call(this,e)},bindHandlers:function(){o.view.MediaFrame.MediaDetails.prototype.bindHandlers.apply(this,arguments),this.on("toolbar:render:replace-audio",this.renderReplaceToolbar,this),this.on("toolbar:render:add-audio-source",this.renderAddSourceToolbar,this)},createStates:function(){this.states.add([new o.controller.AudioDetails({media:this.media}),new o.controller.MediaLibrary({type:"audio",id:"replace-audio",title:a.audioReplaceTitle,toolbar:"replace-audio",media:this.media,menu:"audio-details"}),new o.controller.MediaLibrary({type:"audio",id:"add-audio-source",title:a.audioAddSourceTitle,toolbar:"add-audio-source",media:this.media,menu:!1})])}}),o.view.MediaFrame.VideoDetails=o.view.MediaFrame.MediaDetails.extend({defaults:{id:"video",url:"",menu:"video-details",content:"video-details",toolbar:"video-details",type:"link",title:a.videoDetailsTitle,priority:120},initialize:function(e){e.DetailsView=o.view.VideoDetails,e.cancelText=a.videoDetailsCancel,e.addText=a.videoAddSourceTitle,o.view.MediaFrame.MediaDetails.prototype.initialize.call(this,e)},bindHandlers:function(){o.view.MediaFrame.MediaDetails.prototype.bindHandlers.apply(this,arguments),this.on("toolbar:render:replace-video",this.renderReplaceToolbar,this),this.on("toolbar:render:add-video-source",this.renderAddSourceToolbar,this),this.on("toolbar:render:select-poster-image",this.renderSelectPosterImageToolbar,this),this.on("toolbar:render:add-track",this.renderAddTrackToolbar,this)},createStates:function(){this.states.add([new o.controller.VideoDetails({media:this.media}),new o.controller.MediaLibrary({type:"video",id:"replace-video",title:a.videoReplaceTitle,toolbar:"replace-video",media:this.media,menu:"video-details"}),new o.controller.MediaLibrary({type:"video",id:"add-video-source",title:a.videoAddSourceTitle,toolbar:"add-video-source",media:this.media,menu:!1}),new o.controller.MediaLibrary({type:"image",id:"select-poster-image",title:a.videoSelectPosterImageTitle,toolbar:"select-poster-image",media:this.media,menu:"video-details"}),new o.controller.MediaLibrary({type:"text",id:"add-track",title:a.videoAddTrackTitle,toolbar:"add-track",media:this.media,menu:"video-details"})])},renderSelectPosterImageToolbar:function(){this.setPrimaryButton(a.videoSelectPosterImageTitle,function(t,e){var i=[],a=e.get("selection").single();t.media.set("poster",a.get("url")),e.trigger("set-poster-image",t.media.toJSON()),s.each(wp.media.view.settings.embedExts,function(e){t.media.get(e)&&i.push(t.media.get(e))}),wp.ajax.send("set-attachment-thumbnail",{data:{_ajax_nonce:wp.media.view.settings.nonce.setAttachmentThumbnail,urls:i,thumbnail_id:a.get("id")}})})},renderAddTrackToolbar:function(){this.setPrimaryButton(a.videoAddTrackTitle,function(e,t){var i=t.get("selection").single(),a=e.media.get("content");-1===a.indexOf(i.get("url"))&&(a+=['<track srclang="en" label="English"kind="subtitles" src="',i.get("url"),'" />'].join(""),e.media.set("content",a)),t.trigger("add-track",e.media.toJSON())})}}),o.view.MediaDetails=o.view.Settings.AttachmentDisplay.extend({initialize:function(){s.bindAll(this,"success"),this.players=[],this.listenTo(this.controller,"close",o.mixin.unsetPlayers),this.on("ready",this.setPlayer),this.on("media:setting:remove",o.mixin.unsetPlayers,this),this.on("media:setting:remove",this.render),this.on("media:setting:remove",this.setPlayer),this.events=s.extend(this.events,{"click .remove-setting":"removeSetting","change .content-track":"setTracks","click .remove-track":"setTracks","click .add-media-source":"addSource"}),o.view.Settings.AttachmentDisplay.prototype.initialize.apply(this,arguments)},prepare:function(){return s.defaults({model:this.model.toJSON()},this.options)},removeSetting:function(e){var t=i(e.currentTarget).parent(),e=t.find("input").data("setting");e&&(this.model.unset(e),this.trigger("media:setting:remove",this)),t.remove()},setTracks:function(){var t="";s.each(this.$(".content-track"),function(e){t+=i(e).val()}),this.model.set("content",t),this.trigger("media:setting:remove",this)},addSource:function(e){this.controller.lastMime=i(e.currentTarget).data("mime"),this.controller.setState("add-"+this.controller.defaults.id+"-source")},setPlayer:function(){!this.players.length&&this.media&&this.players.push(new MediaElementPlayer(this.media,this.settings))},setMedia:function(){return this},success:function(e){var t=e.attributes.autoplay&&"false"!==e.attributes.autoplay;"flash"===e.pluginType&&t&&e.addEventListener("canplay",function(){e.play()},!1),this.mejs=e},render:function(){var e=this;return o.view.Settings.AttachmentDisplay.prototype.render.apply(this,arguments),setTimeout(function(){e.resetFocus()},10),this.settings=s.defaults({success:this.success},t),this.setMedia()},resetFocus:function(){this.$(".embed-media-settings").scrollTop(0)}},{instances:0,prepareSrc:function(e){var t=o.view.MediaDetails.instances++;return s.each(i(e).find("source"),function(e){e.src=[e.src,-1<e.src.indexOf("?")?"&":"?","_=",t].join("")}),e}}),o.view.AudioDetails=o.view.MediaDetails.extend({className:"audio-details",template:o.template("audio-details"),setMedia:function(){var e=this.$(".wp-audio-shortcode");return e.find("source").length?(e.is(":hidden")&&e.show(),this.media=o.view.MediaDetails.prepareSrc(e.get(0))):(e.hide(),this.media=!1),this}}),o.view.VideoDetails=o.view.MediaDetails.extend({className:"video-details",template:o.template("video-details"),setMedia:function(){var e=this.$(".wp-video-shortcode");return e.find("source").length?(e.is(":hidden")&&e.show(),e.hasClass("youtube-video")?this.media=e.get(0):this.media=o.view.MediaDetails.prepareSrc(e.get(0))):(e.hide(),this.media=!1),this}})}(jQuery,_,Backbone);
\ No newline at end of file
diff --git a/wp-includes/media.php b/wp-includes/media.php
index 252765fafc..81e2f59b35 100644
--- a/wp-includes/media.php
+++ b/wp-includes/media.php
@@ -2862,7 +2862,8 @@ function wp_enqueue_media( $args = array() ) {
 		/** This filter is documented in wp-admin/includes/media.php */
 		'captions'  => ! apply_filters( 'disable_captions', '' ),
 		'nonce'     => array(
-			'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
+			'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+			'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
 		),
 		'post'    => array(
 			'id' => 0,
diff --git a/wp-includes/version.php b/wp-includes/version.php
index e6dbe77e63..3405d64368 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.1.37';
+$wp_version = '4.1.38';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.