The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
Omni is Vulnerable to DoS via Empty Create/Update Resource Requests