Plugin icon

OneSignal – Web Push Notifications

onesignal-free-web-push-notifications

Vulnerabilities:

3

Last Updated:

April 7, 2026

Active Installs:

70000

Published
Title
Fixed in
CVSS
Published
2026-04-15
Title
OneSignal – Web Push Notifications < 3.8.1 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'
Fixed in
Fixed in 3.8.1
CVSS
3.1 (low)
Published
2025-12-15
Title
OneSignal – Web Push Notifications < 3.6.2 - Missing Authorization to Unauthenticated Plugin Settings Update
Fixed in
Fixed in 3.6.2
CVSS
5.3 (medium)
Published
2019-07-18
Title
OneSignal Web Push Notifications - Stored XSS
Fixed in
Fixed in 1.17.8
CVSS
5.4 (medium)