https://cybertoolchain.io/tools/wpscan New releases and features in WPScan, tracked by The Cyber Toolchain. en Tue, 27 Oct 2026 19:09:54 GMT https://github.com/wpscanteam/wpscan/releases/tag/v4.2.0 https://github.com/wpscanteam/wpscan/releases/tag/v4.2.0 Tue, 27 Oct 2026 19:09:54 GMT WPScan v4.2.0 adds `--max-response-size` to cap response reads and improves SARIF aborted-run reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--max-response-size MiB` flag to stop reading any response once it exceeds the specified size (default 16 MiB, max 2047, `0` disables the cap), guarding against memory exhaustion on targets serving huge or endless responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • SARIF output now reports aborted runs as unsuccessful, with the abort reason recorded in `toolExecutionNotifications`, so consumers show an aborted scan as a failed analysis instead of a clean run with zero alerts. Breaking changes: • Responses larger than 16 MiB are now truncated by default; use `--max-response-size 0` to restore the previous unbounded behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wpscan https://github.com/wpscanteam/wpscan/releases/tag/v4.1.0 https://github.com/wpscanteam/wpscan/releases/tag/v4.1.0 Thu, 23 Jul 2026 15:18:09 GMT WPScan v4.1.0 adds opt-in local vulnerability database for enterprise customers via `--enterprise-db-token` • Adds `--enterprise-db-token TOKEN` flag (also settable via the `WPSCAN_ENTERPRISE_DB_TOKEN` environment variable or the `enterprise_db_token` config-file key) to scan against a local vulnerability database dump instead of the online API, with no per-request limits. • When `--enterprise-db-token` is set, WPScan downloads `plugins.json.gz`, `themes.json.gz`, and `wordpresses.json.gz` from `enterprise-data.wpscan.org` (authenticated via the `X-DB-JSON-AUTH` header) and reads vulnerability data locally — API status is reported as plan `enterprise` with `Unlimited` requests remaining. • `--enterprise-db-token` and `--api-token` are mutually exclusive (including via their environment variables); supplying both raises an error, and the token is redacted from logged command lines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wpscan https://github.com/wpscanteam/wpscan/releases/tag/v4.0.0 https://github.com/wpscanteam/wpscan/releases/tag/v4.0.0 Tue, 19 May 2026 15:12:51 GMT WPScan 4.0 adds authenticated enumeration, SARIF/JSONL output, SAML support, backup-folder scanning, and PoC vuln data. • Adds `--wp-auth` option for WordPress Application Password authentication, enabling authoritative plugin/theme inventory via authenticated enumeration. • Adds `--format sarif` output format for direct CI/CD pipeline integration. • Adds `--format jsonl` streaming output format for real-time, line-by-line results consumption. • Adds `--expect-saml` flag to support SAML-protected WordPress targets. • Adds backup folder enumeration via `-e backup-folders` (alias `-e bf`). • Adds `--exclude-vulns` option to filter out specific vulnerabilities by UUID from scan output. • Adds `--wordlist-skip N` option to resume interrupted brute-force attacks at a specific wordlist offset. • Adds `--max-retries N` option for automatic retry of failed brute-force requests. • Adds `--follow-redirect` option to automatically follow HTTP redirects during scanning. • Adds `--proxy-target-only` option to route only target traffic through the proxy, leaving other requests direct. • Displays Proof-of-Concept information alongside vulnerability findings in scan output. • Shows active install counts and last-updated dates for detected plugins and themes sourced from WordPress.org API. • Includes audit metadata (command line and hostname) in scan output for traceability. • Streams plugin, theme, and user results to output in real-time as they are discovered. • Adds detection support for the SearchWP premium plugin via a new dynamic finder. • HTTP status code tracking now warns when excessive errors are detected during a scan. Breaking changes: • Ruby 3.0, 3.1, and 3.2 are no longer supported; Ruby 3.3+ is now required. • Plugin and config-backup enumeration is no longer performed by default; explicit `-e ap` (or other `-e` flags) must be passed to scan plugins. • The `--timthumbs-detection`, `--config-backups-detection`, `--db-exports-detection`, and `--medias-detection` options have been removed. • New installations use XDG Base Directory paths (`~/.cache/wpscan/db` and `~/.config/wpscan/`) instead of `~/.wpscan/`. • `--plugins-list` and `--themes-list` now override `-e` options rather than combining with them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wpscan