I'm having this same issue; here's our osTicket info:

The mentioned patch isn't in 1.18.4, so I applied it manually. I logged out and logged back in, but I still can't add images, either inline or via file attachment. When I do, I get the same invalid CSRF token error as shown in the first post.
We do use the plug-in to save attachments in the filesystem, and it's installed and claims to be working fine. Any ideas on what else might be going wrong?