WordPress OneSignal plugin version 1.17.5 suffers from a persistent cross site scripting vulnerability.