onyx

onyx --cves cve-2021-29447

CVE-2021-29447

HIGHPOCWordPress
score
<0.1
cvss
7.1
epss
85.7%
published
2021-04-15
kev added
—
first seen

WordPress contains an XML External Entity (XXE) vulnerability caused by improper XML parsing in the Media Library, letting users with upload capabilities access internal files, exploit requires PHP 8.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2021-04-15 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.htmlXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 85.7%2026-09-23: epss 85.7%2026-09-24: epss 85.7%2026-09-25: epss 85.7%2026-09-26: epss 85.7%2026-09-27: epss 85.7%2026-09-28: epss 85.7%2026-09-29: epss 85.7%2026-09-30: epss 85.7%2026-10-01: epss 85.7%2026-10-02: epss 85.7%2026-10-03: epss 85.7%2026-10-04: epss 85.7%2026-10-05: epss 85.7%2026-10-06: epss 85.7%2026-10-07: epss 85.7%2026-10-08: epss 85.7%2026-10-09: epss 85.7%2026-10-10: epss 85.7%2026-10-11: epss 85.7%2026-10-12: epss 85.7%2026-10-13: epss 85.7%2026-10-14: epss 85.7%2026-10-15: epss 85.7%2026-10-16: epss 85.7%2026-10-18: epss 85.7%2026-10-19: epss 85.7%2026-10-20: epss 85.7%2026-10-21: epss 85.7%85.7%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.html

Exploit availability

Weaknesses

CWE-611

References 7