Filters apply as you choose them.
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.