Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H N N 8.6 .0044 36.5 —
AFFECTED Product Versions Fixed Yo 1.1 – —
TIMELINE Sep 9 Reserved by WPScan Sep 17 Published (CNA: WPScan) Sep 20 EXPLOIT PUBLISHED — CVE-2026-87963 (Unknown Yo). Public exploit reference added.
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.
| Date | Event | Detail |
|---|---|---|
| September 9, 2026 | Reserved | Reserved by WPScan |
| September 17, 2026 | Published | Published (CNA: WPScan) |
| September 20, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-87963 (Unknown Yo). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | Yo | — | 1.1 | — |
Authoritative record: CVE-2026-87963 at cve.org
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-87963 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
