What’s Vulnerable › Products

WPGraphQL vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your WPGraphQL version is affected

Latest WPGraphQL vulnerabilities

• CVE-2026-109703 — WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability (CVSS 5.3)
• CVE-2026-40762 — WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability (CVSS 7.5)
• CVE-2021-47959 — WordPress Plugin WPGraphQL 1.3.5 Denial of Service (CVSS 7.5)
• CVE-2025-68604 — WordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
• CVE-2022-1563 — WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure (CVSS 5.3)
• CVE-2023-23684 — WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 6.5)
• CVE-2019-9881 — (CVSS 5.3)
• CVE-2019-9880 — (CVSS 9.1)
• CVE-2019-9879 — (CVSS 9.8)