Skip to content
OpenAdvisories

Vendor

onesignal

3 known vulnerabilities.

Products

OneSignal – Web Push Notifications 2 react-native-onesignal 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-3155

    OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'

    The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …

    onesignal OneSignal – Web Push Notifications Web / CMS