The companion-sitemap-generator plugin prior to 3.7.0 for WordPress has CSRF.
codeermeneer companion sitemap generator