EIP-2026-103342

This exploit demonstrates a stored XSS vulnerability in the WordPress OneSignal plugin (version 1.17.5) by injecting malicious JavaScript into the 'subdomain' POST parameter. The payload triggers a confirmation dialog when the form is submitted, proving the vulnerability.