OneSignal – Web Push Notifications

OneSignal – Web Push Notifications has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 4.9, and the most serious one scores 6.4 out of 10.

The most common weakness is Missing Authorization, behind 2 of the records (67%). Other recurring categories include Cross-Site Scripting.

Every one of the 3 issues recorded for OneSignal – Web Push Notifications has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. OneSignal – Web Push Notifications is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.9/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all OneSignal – Web Push Notifications vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2019-15827

OneSignal Web Push Notifications <=1.17.7 - Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
OneSignal – Web Push Notifications banner
Latestv3.9.3

OneSignal – Web Push Notifications

OneSignal Push Notifications

Author

OneSignal Push Notifications

4.3(360)
86/100
Last Updated
2026-09-02 (10d ago)
Active Installs
60,000+
Downloads
5,305,642
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2015-05-01 (12y ago)

OneSignal is an easy way to increase user engagement. Use OneSignal to send visitors targeted push notifications so they keep coming back. It takes just a few minutes to install. As a WordPress VIP Gold Partner, OneSignal has been rigorously tested to handle even the highest volume use cases with reliability and ease of use. After setup, your visitors opt-in to receive push notifications when you publish a new post. Visitors receive these notifications even after they’ve left your website, thus driving re-engagement. You can configure notification delivery at preset intervals, create user segments, and customize the opt-in process for visitors. OneSignal’s free plan allows targeting up to 10,000 subscribers with push notifications. Contact support@onesignal.com if you have any questions. We’d love to hear from you! Company OneSignal is trusted by over 1.8M+ developers and marketing strategists. We power push notifications for everyone from early stage startups to Fortune 500 Companies, sending over 6 billion notifications per day. It is the most popular push notification plugin on WordPress with 100,000+ installations. Features Supports Chrome (Desktop & Android), Safari (Mac OS X), Microsoft Edge (Desktop & Android), Opera (Desktop & Android) and Firefox (Desktop & Android) on both HTTP and HTTPS sites. Automatic Notifications – Send notifications to followers every time you publish a new post. Or set up a reminder that gets automatically sent to them if they haven’t visited for a few days. Targeting Segments – Send notifications to specific visitors based on language, number of times they’ve visited your blog, or even set up your own user attributes that you can target. Opt-In Customization – Choose when and how to ask your visitors to opt-in to browser notifications. Customize the prompt they first see. Real Time Analytics – See your notifications being delivered in real time, and watch them as they convert into visitors. A/B Testing – Try out different messages to a smaller set of your visitors to figure out which messages are more effective and then send the more effective message to the rest of your visitors! Scheduled Notifications – Schedule notifications to be delivered in the future, based on a user’s time zone, or even based on the same time of day they last visited your website.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C