≤ 1.1.2
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.