Onesignal Onesignal-free-web-push-notifications — known CVE vulnerabilities

Every CVE whose affected-product data names Onesignal Onesignal-free-web-push-notifications, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (1)

• CVE-2019-15827 — CVSS 5.4 (medium): The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.