OneSignal/OneSignal-WordPress-Plugin

GitHub

github.com

Releases58

Frequency2 months 1 week

Last Release about 1 month ago

Stars81

OneSignal makes engaging customers simple and is the fastest, most reliable service to send push notifications, in-app messages, SMS, and emails. This plugin makes it easy to integrate your Wordpress site with OneSignal. https://onesignal.com

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-13950 ↗	Dec 15, 2025Monday, 15 December 2025, 15:15	5.3 MEDIUM	—
The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests.