CVE-2019-15827 - The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter

MEDIUM

The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter

Published Aug 30, 2019

5.4

MEDIUM

CVSS 3.0

EPSS 1.06%

The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6744		Advisory
https://wordpress.org/plugins/onesignal-free-web-push-notifications/#developers		x_refsource_MISCProductThird Party Advisory
https://wpvulndb.com/vulnerabilities/9478		x_refsource_MISCThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5530.php		x_refsource_MISCExploitThird Party Advisory