The noun CSRF can be countable or uncountable.

In more general, commonly used, contexts, the plural form will also be CSRF.

However, in more specific contexts, the plural form can also be CSRFs e.g. in reference to various types of CSRFs or a collection of CSRFs.