September 21, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-87774NVD

Vulnerability Summary

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Severity Level
UNKNOWN
Published Date
Sep 18, 2026
Last Modified
Sep 18, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.32%Probability
Root Weakness (CWE)
CWE-89: SQL Injection ↗
Improper neutralization of special elements used in an SQL command, allowing attackers to modify queries.

Affected & Patched Versions

Affected Versions
  • Unknown Tz Weekly Radio Schedule <= 1.8.1
Patched Versions
  • Unknown Tz Weekly Radio Schedule 1.8.1
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.

External References