Onesignal

4 CVEs across 3 Onesignal products. Browse Onesignal vulnerabilities, severities, and proof-of-concept exploits.

Onesignal products with known CVEs

ProductCVEs
Onesignal – Web Push Notifications2
Onesignal-Free-Web-Push-Notifications1
React-Native-Onesignal1
Onesignal CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-3155Low3.12026-04-16The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the p…
CVE-2025-13950Medium5.32025-12-15The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setting…
CVE-2023-28430High7.32023-03-27OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e…
CVE-2019-15827Medium5.42019-08-30The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.