WordPress security by component

OneSignal – Web Push Notifications

Plugin description

OneSignal – Web Push Notifications is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Apr 16, 2026; the highest CVE/CNA score is 5.3.

Plugin slug: onesignal-web-push-notifications

Latest vulnerability

CVE-2026-3155: OneSignal – Web Push Notifications: A security weakness

OneSignal – Web Push Notifications is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.8.0.

PublishedApr 16, 2026

Known safe version> 3.8.0

		Safe version
Apr 16, 2026	CVE-2026-3155 OneSignal – Web Push Notifications: A security weakness OneSignal – Web Push Notifications is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.8.0.	> 3.8.0	CVE3.1 NVDPending
Dec 15, 2025	CVE-2025-13950 OneSignal – Web Push Notifications: A security weakness OneSignal – Web Push Notifications is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending