System	Score	Found at
epss	0.87878	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
epss	0.88883	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
epss	0.88883	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
epss	0.89218	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
epss	0.89218	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
epss	0.89218	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
epss	0.89218	https://api.first.org/data/v1/epss?cve=CVE-2021-29447
cvssv2	4.0	https://nvd.nist.gov/vuln/detail/CVE-2021-29447
cvssv3.1	6.5	https://nvd.nist.gov/vuln/detail/CVE-2021-29447
archlinux	Medium	https://security.archlinux.org/AVG-1831

Reference id	Reference type	URL
		http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.html
		http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.html
		https://api.first.org/data/v1/epss?cve=CVE-2021-29447
		https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29447
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29450
		https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhh
		https://lists.debian.org/debian-lts-announce/2021/04/msg00017.html
		https://wordpress.org/news/category/security/
		https://www.debian.org/security/2021/dsa-4896
AVG-1831		https://security.archlinux.org/AVG-1831
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2021-29447	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/50304.sh
CVE-2021-29447		https://nvd.nist.gov/vuln/detail/CVE-2021-29447

Data source	Exploit-DB
Date added	Sept. 20, 2021
Description	WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)
Ransomware campaign use	Unknown
Source publication date	Sept. 20, 2021
Exploit type	webapps
Platform	php
Source update date	Sept. 20, 2021

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-29447

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-29447

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Percentile	0.99441
EPSS Score	0.87878
Published At	Aug. 16, 2025, 12:55 p.m.

Date	Actor	Action	Source	VulnerableCode Version
2025-07-31T11:37:55.990220+00:00	Arch Linux Importer	Import	https://security.archlinux.org/AVG-1831	37.0.0