What's Changed

Added

• --max-response-size MiB caps how much of any response is read (default 16 MiB, 0 disables), guarding against memory exhaustion on targets serving huge or endless responses by @gnuletik in #2091

Changed

• Responses larger than 16 MiB are now truncated by default. Use --max-response-size 0 to restore the previous unbounded behavior. by @gnuletik in #2091
• SARIF now reports aborted runs as unsuccessful, with the abort reason in toolExecutionNotifications. Consumers will show an aborted scan as a failed analysis instead of a clean run with zero alerts. The CLI exit code is unchanged. by @derekxmartin in #2094

Fixed

• Scan no longer aborts with "long too big to dump" when a response is too large to cache by @gnuletik in #2090
• JSON output no longer crashes when the WP JSON API returns users without a slug by @gnuletik in #2093
• SARIF includes parent-theme advisories by @derekxmartin in #2095

Maintenance

• Docker image now built on ruby:4.0.9-alpine (Alpine 3.24), and Dependabot tracks the base image by @Initsogar in #2101
• CLI integration tests also run with a free API token by @ArSn in #2081
• Dependency bumps: rubocop, simplecov, webmock

New Contributors

• @gnuletik made their first contribution in #2093
• @derekxmartin made their first contribution in #2094

Full Changelog: v4.1.0...v4.2.0

What's Changed

Added

• Add opt-in local vulnerability database support (--enterprise-db-token) by @ArSn in #2073

Maintenance

• Add 7-day Dependabot cooldown and limit Actions to major versions by @ArSn in #2072
• Update simplecov requirement from ~> 0.22.0 to ~> 1.0.0 by @dependabot[bot] in #2075
• Fix SimpleCov 1.0 deprecation warnings by @ArSn in #2076
• Run one non-slow example per dynamic finder code path by @ArSn in #2077

Full Changelog: v4.0.1...v4.1.0

What's Changed

Fixed

• Updated WPScan CLI to use WPScan API v4, which includes correct handling of backported/multi-range vulnerability fixes by @Initsogar in #2053

Maintenance

• Fixed WPSCAN_API_TOKEN test isolation by @Initsogar in #2049
• Fixed a RuboCop compatibility issue around safe navigation and empty checks by @Initsogar in #2062
• Docker release workflow now pushes the versioned image tag and, for stable releases, the latest tag in the same release build by @ArSn in #2058
• Implemented additional previously skipped specs by @Initsogar in #2048
• Updated pinned GitHub Actions and Docker build workflow dependencies

Full Changelog: v4.0.0...v4.0.1

What's Changed

⚠️ Breaking Changes: This is a major version release (4.0.0) and contains breaking changes. It is not 100% backwards compatible with version 3.x. Please review the changes below.

TL;DR for upgrading from 3.x

• Ruby 3.3+ required (Ruby 4.0 supported)
• WPScan no longer auto-scans plugins by default—use -e ap to scan plugins
• New --wp-auth option for accurate WordPress authentication-based enumeration
• New --expect-saml flag for SAML authentication support
• New --format jsonl (streaming) and --format sarif output formats
• New installations use XDG directories (~/.cache/wpscan/db, ~/.config/wpscan/)

Added

• --wp-auth option for WordPress Application Password authentication providing authoritative plugin/theme inventory by @ArSn in #2021
• --format jsonl streaming output format for real-time results by @ArSn in #2012
• --format sarif output format for CI/CD integration by @ArSn in #2000
• --max-retries N option for automatic brute force request retry by @Initsogar in #2028
• --wordlist-skip N option to resume interrupted brute force attacks by @Initsogar in #2025
• --follow-redirect option to automatically follow HTTP redirects by @Initsogar in #1995
• --proxy-target-only option for selective proxy usage by @ArSn in #1975
• --expect-saml flag for SAML authentication support by @Initsogar in #2035
• --exclude-vulns option for UUID-based vulnerability exclusion by @Initsogar in #2017
• Backup folder enumeration via -e backup-folders or -e bf by @Initsogar in #2024
• Ruby 4.0 support by @Usiel in #1953
• XDG Base Directory support for new installations: ~/.cache/wpscan/db and ~/.config/wpscan/ (existing installations continue using ~/.wpscan/) by @alichtman in #1815 and @noraj in #2029
• HTTP status code tracking with warnings for excessive errors by @Initsogar in #2009
• Proof-of-Concept information in vulnerability output by @Initsogar in #2005
• Last updated date for plugins and themes from WordPress.org API by @ArSn in #2015
• Active install count for detected plugins and themes by @ArSn in #2013
• Audit information (command line and hostname) in scan output by @Initsogar in #2006
• Comprehensive test coverage: E2E integration tests, acceptance tests, and implemented skipped tests by @Initsogar and @ArSn in #1978, #1989, #2023, #2037
• Dynamic finder for SearchWP premium plugin by @ArSn in #1993
• AGENTS.md file for AI coding assistant guidance by @Initsogar in #1966

Changed

• Plugin, theme, and user results now stream to output in real-time by @ArSn in #2027
• Improved color handling: file output defaults to no color, respects NO_COLOR environment variable and TTY detection by @ArSn in #2031
• --plugins-list and --themes-list now override -e options by @ArSn in #2011
• Merged cms_scanner gem into wpscan codebase including 8.5k+ lines of tests by @ArSn in #1977, #1979
• Integrated opt_parse_validator gem into repository by @ArSn in #1980
• Temporary directory now respects $TMPDIR environment variable by @ArSn in #1994
• Limited maximum redirects to prevent infinite loops by @ArSn in #2022
• Maximum PHP log file size limit (20 MiB default) to prevent memory exhaustion by @ArSn in #1992
• Standardized on Pathname objects for path handling across codebase by @Initsogar in #2034, #2038
• Improved error messages across the board (database updates, API errors, permissions, thresholds) by @Initsogar and @ArSn in #1997, #1998, #2002, #2020, #2026, #2032
• Improved CI/CD workflow with optimizations and better coverage reporting by @Initsogar and @ArSn in #1963, #1965, #1976, #2007

Removed

• Default plugin and config backup enumeration - must use explicit -e flag by @Initsogar in #2008
• --timthumbs-detection, --config-backups-detection, --db-exports-detection, and --medias-detection options by @Initsogar in #2033
• Support for Ruby 3.0, 3.1, and 3.2 - minimum version is now 3.3 by @ArSn in #1973

Fixed

• Errno::ENAMETOOLONG error when using long comma-separated lists by @Initsogar in #1996
• Non-JSON responses from WPScan API now handled gracefully by @Initsogar in #2001
• Invalid WordPress JSON response handling by @alexsanford in #1818

Security

• Improved security and code quality tooling: Qlty CI integration, GitHub Actions pinning, template injection fix, replaced CodeClimate by @ArSn in #2039, #2040, #2042, #2043

New Contributors

• @dkmyta made their first contribution in #1905
• @l0pens made their first contribution in #1913
• @Initsogar made their first contribution in #1961
• @Usiel made their first contribution in #1953
• @lambdakilo made their first contribution in #1847
• @AMetIR made their first contribution in #1740
• @alichtman made their first contribution in #1815
• @musaabhasan made their first contribution in #2003
• @noraj made their first contribution in #2029

Thank you to everyone who contributed to this release!

Full Changelog: v3.8.28...v4.0.0

• Minor:
  • Updated deps
  • Support for Ruby 3.4
  • Fixed parsing error when using ruby 3.4 - Ref #1881
  • Updated Docker Image to use Ruby 3.4.2
  • Fixed a typo in the Readme - Ref #1884

What's Changed

• Fixed various warnings with Ruby 3.3 by @erwanlr in #1858

Full Changelog: v3.8.26...v3.8.27

What's Changed

• Re-add ruby 3.2 to build by @alexsanford in #1803
• README: Inline to code block for macOS download by @devidw in #1711
• Fixed #1759 by @0n1shi in #1787
• Fix case where a theme slug is all non-latin characters by @alexsanford in #1814
• Updates DFs by @erwanlr in #1820
• Bump docker/login-action from 2.2.0 to 3.0.0 by @dependabot in #1807
• Bump docker/build-push-action from 4 to 5 by @dependabot in #1805
• Bump docker/setup-buildx-action from 2 to 3 by @dependabot in #1804
• Bump docker/setup-qemu-action from 2 to 3 by @dependabot in #1806
• Update simplecov requirement from ~> 0.21.0 to ~> 0.22.0 by @dependabot in #1765
• Updates Deps by @erwanlr in #1854
• Populate valid versions from metadata, too by @Nirusu in #1850
• Bump docker/build-push-action from 5 to 6 by @dependabot in #1857
• Bump docker/login-action from 3.0.0 to 3.3.0 by @dependabot in #1856
• Updates cms-scanner dep by @erwanlr in #1855

New Contributors

• @alexsanford made their first contribution in #1803
• @devidw made their first contribution in #1711
• @0n1shi made their first contribution in #1787
• @Nirusu made their first contribution in #1850

Full Changelog: v3.8.25...v3.8.26

What's Changed

• Bump actions/checkout from 3 to 4 by @dependabot in #1798
• Update webmock requirement from ~> 3.18.1 to ~> 3.19.1 by @dependabot in #1797
• Bump docker/login-action from 2.1.0 to 2.2.0 by @dependabot in #1785

Full Changelog: v3.8.24...v3.8.25

This is a management release to ensure that the gem is properly pushed to the rubygems channel, as this has failed with the last tagged release. No functionality has changed since v3.8.23.

• Minor:
  • Updated --password-attack help text to mentions that xmlrpc multi call attack will only work against WP < 4.4 - Ref #1755
  • Fixed a small bug where the API calls would fail when both a proxy with authentication and an API token were used at the same time - ref #1783