Filters apply as you choose them.
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.