The world's leader for mobile push notifications, web push, SMS, email and in-app messaging. Trusted by 2 million+ businesses to send 12 billion+ messages per… - onesignal.com
· 1 month ago
Buy if you run an app or website and want one platform for push, SMS, email, and in-app messaging without upfront cost. Skip it if raw Firebase Cloud Messaging, a simple web-push tool, or your email provider already covers you.
Confidence
Medium. Based on 30+ public sources; many review snippets were truncated, limiting depth.
Ratings
Value for money
Ease of use
Feature depth
Support qualityNo clear evidence either way
Security posture
Pricing
$0/mo
Free
ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Paid (Growth)from ~$9/mo
Best for
→Mobile apps needing push at scale
→Growth teams running multi-channel campaigns
→Developers wanting fast SDK setup
→Starters on a $0 budget
Not for
×Tiny apps where plain FCM is enough
×Teams wanting only email — use a dedicated email tool
WordPress plugin users must patch promptly; CVE-2026-3155 is an auth bypass
medium
Free plan terms have changed before; recheck current limits before committing
medium
Charges based on usage; costs grow with subscriber count
Pros and cons
Pros
+4.7/5 rating across ~1,176 G2 reviews
+Free tier; paid plans start around $9/month
+One platform: mobile push, web push, SMS, email, in-app
+ISO 27001 and ISO 27701 security certified
+Customers report fast setup
Cons
−Some developers have migrated away to Pushwoosh
−Others recommend plain FCM instead
−WordPress plugin has repeated authorization-flaw CVEs
−Usage-based billing complicates cost forecasting
Sources & method
- 12 sources - Core platform holds ISO 27001/27701 certifications; its WordPress plugin has a history of CVEs, including a 2026 auth bypass (CVE-2026-3155).
official x4review x5security x2news x1
CVE-2026-3155: WordPress plugin auth bypass, Authorization flaw in the OneSignal Web Push Notifications WordPress plugin.
CVE-2025-13950: missing authorization, Allowed authenticated subscriber-level post meta deletion via post ID in the WordPress plugin.
XSS in WordPress plugin <=1.17.7, Cross-site scripting vulnerability in an older plugin version.
Key stats
Value for money: 4/5
Rating
$0/mo
Starting price
12
Sources
Analyzed
Value for money: 4/5. Real free tier; usage costs climb at scale
Ease of use: 4/5. Reviewers call it easiest way into push
Feature depth: 4/5. Push, SMS, email, in-app in one platform
Support quality. No clear evidence either way
Security posture: 3/5. ISO certified, but plugin CVEs recur
4.7/5 G2 rating ~1,176–1,231 reviews
$0/mo Starting price Paid plans from ~$9/mo
Yes Free tier Free plan with usage limits
$84M Total funding $50M Series C in 2022
Pricing
Free
$0/mo
All channels access
Usage limits apply
Paid (Growth)
from ~$9/mo
Higher limits
Scales with subscriber count
Security
Core platform holds ISO 27001/27701 certifications; its WordPress plugin has a history of CVEs, including a 2026 auth bypass (CVE-2026-3155).
CVE-2026-3155: WordPress plugin auth bypassAuthorization flaw in the OneSignal Web Push Notifications WordPress plugin.⁷
CVE-2025-13950: missing authorizationAllowed authenticated subscriber-level post meta deletion via post ID in the WordPress plugin.⁸
XSS in WordPress plugin <=1.17.7Cross-site scripting vulnerability in an older plugin version.
What users say
Most users rate OneSignal highly (4.7/5 on G2), though a vocal group of developers have left for Pushwoosh or raw FCM.
Comments
One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.
No comments yet.