Skip to content
OpenAdvisories

Vendor

wp-graphql

4 known vulnerabilities.

Products

wp-graphql 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.7
    CVE-2026-27938 Public exploit

    WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

    WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull_request.bod…

    wp-graphql wp-graphql