Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-87774

Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Tz Weekly Radio Schedule

Default version status: unknown

  • 0 to ≤ 1.8.1affected

References