CVE-2026-87774
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Risk Assessment
Attackers can access sensitive data such as user information, potentially leading to privacy breaches and further attacks.
Recommendation
Update the Tz Weekly Radio Schedule plugin to a version newer than 1.8.1 that includes input sanitization fixes.
Other vulnerabilities in Tz Weekly Radio Schedule
Original NVD description (English source)
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS