The ultimate-category-excluder plugin prior to 1.2 for WordPress allows ultimate-category-excluder.php CSRF.
infolific ultimate category excluder