• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

wpscanteam / wpscan
95%

Build:
DEFAULT BRANCH: master
Repo Added 01 Oct 2014 07:58PM UTC
Files 243
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: SELECT
CHANGE BRANCH
x
  • No branch selected
  • 3.3.0
  • 3.3.3
  • 3.4.0
  • 3.4.4
  • 3.4.5
  • 3.5.0
  • 3.5.1
  • 3.5.5
  • 3.5.6
  • 3.7.0
  • 3.9.0
  • 404-detection
  • add-jsonl-support
  • add-last-updated-for-extensions
  • add-proxy-target-only-option
  • add-qlty
  • add-searchwp-dynamic-finder
  • add-uid-guid-to-access-errors
  • add/follow-redirect-opt
  • add/hostname-cli-command
  • add/integration-tests
  • add/poc-availability
  • add/saml-authentication
  • avoid-memory-leak-big-static-files
  • avoid-template-injection
  • bump-version-4-0-0
  • bump-version-4-1-0
  • cms-scanner-0.14.2
  • db-backup
  • default-cli-no-color-for-file-output
  • dependabot-cooldown-and-actions-major-only
  • dependabot/bundler/activesupport-gte-7.1-and-lt-8.2
  • dependabot/bundler/addressable-gte-2.5-and-lt-2.10
  • dependabot/bundler/cms_scanner-gte-0.0.41.10-and-lt-0.0.43.0
  • dependabot/bundler/cms_scanner-gte-0.5.8-and-lt-0.7.0
  • dependabot/bundler/ethon-gte-0.14-and-lt-0.19
  • dependabot/bundler/ethon-lt-0.14.0
  • dependabot/bundler/memory_profiler-tw-1.0.0
  • dependabot/bundler/memory_profiler-tw-1.1.0
  • dependabot/bundler/public_suffix-gte-4.0.3-and-lt-7.1
  • dependabot/bundler/rake-tw-13.0
  • dependabot/bundler/rspec-its-tw-1.3.0
  • dependabot/bundler/rspec-its-tw-2.0.0
  • dependabot/bundler/rspec-tw-3.10.0
  • dependabot/bundler/rspec-tw-3.11.0
  • dependabot/bundler/rspec-tw-3.12.0
  • dependabot/bundler/rspec-tw-3.13.0
  • dependabot/bundler/rspec-tw-3.9.0
  • dependabot/bundler/rubocop-performance-tw-1.10.0
  • dependabot/bundler/rubocop-performance-tw-1.11.0
  • dependabot/bundler/rubocop-performance-tw-1.12.0
  • dependabot/bundler/rubocop-performance-tw-1.13.0
  • dependabot/bundler/rubocop-performance-tw-1.2.0
  • dependabot/bundler/rubocop-performance-tw-1.3.0
  • dependabot/bundler/rubocop-performance-tw-1.4.0
  • dependabot/bundler/rubocop-performance-tw-1.5.0
  • dependabot/bundler/rubocop-performance-tw-1.6.0
  • dependabot/bundler/rubocop-performance-tw-1.7.0
  • dependabot/bundler/rubocop-tw-0.62.0
  • dependabot/bundler/rubocop-tw-0.63.0
  • dependabot/bundler/rubocop-tw-0.64.0
  • dependabot/bundler/rubocop-tw-0.65.0
  • dependabot/bundler/rubocop-tw-0.66.0
  • dependabot/bundler/rubocop-tw-0.67.1
  • dependabot/bundler/rubocop-tw-0.69.0
  • dependabot/bundler/rubocop-tw-0.70.0
  • dependabot/bundler/rubocop-tw-0.71.0
  • dependabot/bundler/rubocop-tw-0.72.0
  • dependabot/bundler/rubocop-tw-0.73.0
  • dependabot/bundler/rubocop-tw-0.74.0
  • dependabot/bundler/rubocop-tw-0.75.0
  • dependabot/bundler/rubocop-tw-0.76.0
  • dependabot/bundler/rubocop-tw-0.77.0
  • dependabot/bundler/rubocop-tw-0.79.0
  • dependabot/bundler/rubocop-tw-0.80.0
  • dependabot/bundler/rubocop-tw-0.81.0
  • dependabot/bundler/rubocop-tw-0.82.0
  • dependabot/bundler/rubocop-tw-0.83.0
  • dependabot/bundler/rubocop-tw-0.84.0
  • dependabot/bundler/rubocop-tw-0.85.0
  • dependabot/bundler/rubocop-tw-0.87.0
  • dependabot/bundler/rubocop-tw-0.88.0
  • dependabot/bundler/rubocop-tw-0.92.0
  • dependabot/bundler/rubocop-tw-1.0.0
  • dependabot/bundler/rubocop-tw-1.10.0
  • dependabot/bundler/rubocop-tw-1.11.0
  • dependabot/bundler/rubocop-tw-1.12.0
  • dependabot/bundler/rubocop-tw-1.13.0
  • dependabot/bundler/rubocop-tw-1.14.0
  • dependabot/bundler/rubocop-tw-1.15.0
  • dependabot/bundler/rubocop-tw-1.16.0
  • dependabot/bundler/rubocop-tw-1.17.0
  • dependabot/bundler/rubocop-tw-1.19.0
  • dependabot/bundler/rubocop-tw-1.20.0
  • dependabot/bundler/rubocop-tw-1.23.0
  • dependabot/bundler/rubocop-tw-1.25.0
  • dependabot/bundler/rubocop-tw-1.26.0
  • dependabot/bundler/rubocop-tw-1.27.0
  • dependabot/bundler/rubocop-tw-1.3.0
  • dependabot/bundler/rubocop-tw-1.5.0
  • dependabot/bundler/rubocop-tw-1.5.1
  • dependabot/bundler/rubocop-tw-1.6.0
  • dependabot/bundler/rubocop-tw-1.7.0
  • dependabot/bundler/rubocop-tw-1.8.0
  • dependabot/bundler/simplecov-lcov-tw-0.9.0
  • dependabot/bundler/simplecov-tw-0.19.0
  • dependabot/bundler/simplecov-tw-0.20.0
  • dependabot/bundler/simplecov-tw-0.21.0
  • dependabot/bundler/simplecov-tw-0.22.0
  • dependabot/bundler/simplecov-tw-1.0.0
  • dependabot/bundler/simplecov-tw-1.1.0
  • dependabot/bundler/typhoeus-gte-1.3-and-lt-1.7
  • dependabot/bundler/webmock-tw-3.10.0
  • dependabot/bundler/webmock-tw-3.11.0
  • dependabot/bundler/webmock-tw-3.12.0
  • dependabot/bundler/webmock-tw-3.13.0
  • dependabot/bundler/webmock-tw-3.14.0
  • dependabot/bundler/webmock-tw-3.17.0
  • dependabot/bundler/webmock-tw-3.17.1
  • dependabot/bundler/webmock-tw-3.18.1
  • dependabot/bundler/webmock-tw-3.19.0
  • dependabot/bundler/webmock-tw-3.19.1
  • dependabot/bundler/webmock-tw-3.23.1
  • dependabot/bundler/webmock-tw-3.26.0
  • dependabot/bundler/webmock-tw-3.26.1
  • dependabot/bundler/webmock-tw-3.6.0
  • dependabot/bundler/webmock-tw-3.7.0
  • dependabot/bundler/webmock-tw-3.8.0
  • dependabot/bundler/webmock-tw-3.9.0
  • dependabot/github_actions/actions/checkout-2.3.5
  • dependabot/github_actions/actions/checkout-2.4.0
  • dependabot/github_actions/actions/checkout-3
  • dependabot/github_actions/actions/checkout-4
  • dependabot/github_actions/actions/checkout-5
  • dependabot/github_actions/actions/checkout-6
  • dependabot/github_actions/actions/checkout-6.0.3
  • dependabot/github_actions/actions/checkout-7.0.0
  • dependabot/github_actions/actions/checkout-v2.3.4
  • dependabot/github_actions/actions/setup-ruby-1.1.3
  • dependabot/github_actions/actions/upload-artifact-7
  • dependabot/github_actions/docker/build-push-action-3
  • dependabot/github_actions/docker/build-push-action-4
  • dependabot/github_actions/docker/build-push-action-5
  • dependabot/github_actions/docker/build-push-action-6
  • dependabot/github_actions/docker/build-push-action-7
  • dependabot/github_actions/docker/build-push-action-7.2.0
  • dependabot/github_actions/docker/build-push-action-7.3.0
  • dependabot/github_actions/docker/login-action-1.12.0
  • dependabot/github_actions/docker/login-action-1.13.0
  • dependabot/github_actions/docker/login-action-1.14.0
  • dependabot/github_actions/docker/login-action-1.14.1
  • dependabot/github_actions/docker/login-action-2.0.0
  • dependabot/github_actions/docker/login-action-2.1.0
  • dependabot/github_actions/docker/login-action-2.2.0
  • dependabot/github_actions/docker/login-action-3.0.0
  • dependabot/github_actions/docker/login-action-3.3.0
  • dependabot/github_actions/docker/login-action-3.4.0
  • dependabot/github_actions/docker/login-action-3.5.0
  • dependabot/github_actions/docker/login-action-3.6.0
  • dependabot/github_actions/docker/login-action-3.7.0
  • dependabot/github_actions/docker/login-action-4.1.0
  • dependabot/github_actions/docker/login-action-4.2.0
  • dependabot/github_actions/docker/login-action-4.3.0
  • dependabot/github_actions/docker/login-action-4.4.0
  • dependabot/github_actions/docker/setup-buildx-action-2
  • dependabot/github_actions/docker/setup-buildx-action-3
  • dependabot/github_actions/docker/setup-buildx-action-4
  • dependabot/github_actions/docker/setup-buildx-action-4.1.0
  • dependabot/github_actions/docker/setup-buildx-action-4.2.0
  • dependabot/github_actions/docker/setup-qemu-action-2
  • dependabot/github_actions/docker/setup-qemu-action-3
  • dependabot/github_actions/docker/setup-qemu-action-4
  • dependabot/github_actions/docker/setup-qemu-action-4.1.0
  • dependabot/github_actions/docker/setup-qemu-action-4.2.0
  • dependabot/github_actions/ruby/setup-ruby-1.308.0
  • dependabot/github_actions/ruby/setup-ruby-1.310.0
  • dependabot/github_actions/ruby/setup-ruby-1.312.0
  • dependabot/github_actions/ruby/setup-ruby-1.313.0
  • dependabot/github_actions/ruby/setup-ruby-1.314.0
  • dependabot/github_actions/ruby/setup-ruby-1.315.0
  • dependabot/github_actions/ruby/setup-ruby-1.316.0
  • dev
  • dfs
  • disable-daily-docker-build
  • display-active-install-counts
  • docker/push-latest-tag-on-release
  • document-proxying-onion-hostnames
  • dont-build-markdown
  • dont-default-to-hardcoded-tmp
  • dont-overuse-build-workers
  • drop-outdated-ruby-support-again
  • drop-unsupported-ruby-versions
  • erwanlr-patch-1
  • feature/1699-detect-http-errors
  • feature/backup-folder-enumeration
  • feature/brute-force-retries
  • feature/resume-brute-force
  • feature/uuid-vulnerability-exclusion
  • fix-coveralls-setup
  • fix-ruby-3.0
  • fix-secure-runtime-cache-dir
  • fix-simplecov-deprecations
  • fix-vuln-api-spec-env-cleanup
  • fix/add-status-page-link-1567
  • fix/gem-push
  • fix/handle-invalid-wp-json-response
  • fix/implement-skipped-tests
  • fix/json-excluded-vulnerabilities
  • fix/json-notice-view
  • fix/non-latin-character-slugs
  • fix/proxy-auth
  • fix/rubocop-safe-navigation-empty
  • fix/skipped-tests-round2
  • fix/update-db-now-prompt
  • fix/update-db-required/update-now-prompt
  • fixes
  • fixes-warnings
  • full-tests-only-on-master
  • gemfile-lock
  • harden-redirection-limitation
  • ignore-fixture-dependencies
  • implement-sarif-output
  • improve-cf-error-messages
  • improve-update-aborted-msg
  • installer-log-regex-update
  • introduced_in
  • make-extension-lists-take-precedence
  • master
  • matrix-ruby-3.4
  • merge-cms-scanner
  • merge-cms-scanner-tests
  • merge-opt-parse-validator
  • modernize-gemspec-require
  • more-acceptance-tests
  • optparse-pathname-return
  • patch-1
  • pin-action-versions
  • plugin-backup-folder
  • psych
  • refs/heads/master
  • refs/pull/1796/merge
  • refs/pull/1797/merge
  • refs/pull/1798/merge
  • refs/pull/1804/merge
  • refs/pull/1805/merge
  • refs/pull/1806/merge
  • refs/tags/v3.7.10
  • refs/tags/v3.7.11
  • refs/tags/v3.7.9
  • refs/tags/v3.8.0
  • refs/tags/v3.8.1
  • refs/tags/v3.8.10
  • refs/tags/v3.8.11
  • refs/tags/v3.8.12
  • refs/tags/v3.8.13
  • refs/tags/v3.8.14
  • refs/tags/v3.8.15
  • refs/tags/v3.8.16
  • refs/tags/v3.8.17
  • refs/tags/v3.8.18
  • refs/tags/v3.8.19
  • refs/tags/v3.8.2
  • refs/tags/v3.8.20
  • refs/tags/v3.8.21
  • refs/tags/v3.8.22
  • refs/tags/v3.8.23
  • refs/tags/v3.8.24
  • refs/tags/v3.8.25
  • refs/tags/v3.8.26
  • refs/tags/v3.8.27
  • refs/tags/v3.8.28
  • refs/tags/v3.8.3
  • refs/tags/v3.8.4
  • refs/tags/v3.8.5
  • refs/tags/v3.8.6
  • refs/tags/v3.8.7
  • refs/tags/v3.8.8
  • refs/tags/v3.8.9
  • refs/tags/v4.7.9
  • remove-unnecessary-detection-modes
  • revert-1757-master
  • ruby-2.7
  • run-dependabot-daily
  • standardize-pathname-objects
  • stream-output
  • test/pr-2003-secure-cache
  • test/stable-coverage-for-dynamic-finder-specs
  • tweak/add-ruby-3.2-to-build
  • update-deps
  • update/cli-banner
  • update/fix-errno-long-list
  • update/handle-non-json-responses-on-api
  • update/help-document-http-auth
  • update/improve-threshold-docs
  • update/integration-tests-i2
  • update/optimize-ci
  • update/pull-request-template
  • update/raise-error-enum-vp-vt
  • update/release-v4.0.1-version-bump
  • update/remove-default-enumeration
  • usielriedl/ruby-4.0-support
  • v3.3.1
  • v3.3.2
  • v3.3.3
  • v3.4.0
  • v3.4.1
  • v3.4.2
  • v3.4.3
  • v3.4.4
  • v3.4.5
  • v3.5.0
  • v3.5.1
  • v3.5.2
  • v3.5.3
  • v3.5.4
  • v3.5.5
  • v3.6.0
  • v3.6.1
  • v3.6.2
  • v3.6.3
  • v3.7.0
  • v3.7.1
  • v3.7.2
  • v3.7.3
  • v3.7.4
  • v3.7.5
  • v3.7.6
  • v3.7.7
  • v3.7.8
  • wp-auth-inventory
  • wpscan-101-integrate-local-vulnerability-database-dump-support-into
  • wpscan-108-extend-wpscan-cli-integration-tests-to-use-a-free-account
  • wpscan-90-api-v4-migration
  • xdg-config

20 Aug 2026 09:03AM UTC coverage: 95.036%. Remained the same
32351909363

push

github

web-flow
Run the CLI integration tests with a free API token too (#2081)

The integration test only scanned the demo site with the enterprise API token, so
plan specific API regressions were invisible to CI: free plan tokens lost access
to the v4 plugin/theme endpoints in #2079 and it took a user report to surface it.

Scan the same site a second time with a free plan token, and assert the plan each
run actually resolved to so the two runs cannot silently collapse into one.

Both runs now pre-flight their token against the API status endpoint, which costs
no quota (WPScan itself calls it at the start and end of every scan) and fails
with an explicit message when the token is rejected or short on quota. Without it
an exhausted token either aborts with a bare exit code 4, or, when it runs out
mid scan, has its 429s swallowed into empty vulnerability data by DB::VulnApi.get
and looks identical to a detection regression.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2120 of 2617 branches covered (81.01%)

4729 of 4976 relevant lines covered (95.04%)

17247.41 hits per line

Relevant lines Covered
Build:
Build:
4976 RELEVANT LINES 4729 COVERED LINES
17247.41 HITS PER LINE
Source Files on master
  • Tree
  • List 243
  • Changed 231
  • Source Changed 0
  • Coverage Changed 231
Coverage ∆ File Lines Relevant Covered Missed Hits/Line Branch Hits Branch Misses

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32351909363 master Run the CLI integration tests with a free API token too (#2081) The integration test only scanned the demo site with the enterprise API token, so plan specific API regressions were invisible to CI: free plan tokens lost access to the v4 plugin/th... push 20 Aug 2026 09:45AM UTC web-flow github
95.04
32244791281 master Update simplecov requirement from ~> 1.0.0 to ~> 1.1.0 (#2080) Updates the requirements on [simplecov](https://github.com/simplecov-ruby/simplecov) to permit the latest version. - [Release notes](https://github.com/simplecov-ruby/simplecov/releas... push 19 Aug 2026 11:34AM UTC web-flow github
95.04
32242372090 wpscan-108-extend-wpscan-cli-integration-tests-to-use-a-free-account Merge 00e8d8a05 into f6169f006 Pull #2081 19 Aug 2026 10:27AM UTC web-flow github
95.04
32128084353 dependabot/bundler/simplecov-tw-1.1.0 Merge 968e288d4 into f6169f006 Pull #2080 18 Aug 2026 10:47AM UTC web-flow github
95.04
30013649648 master Run one non-slow example per dynamic finder code path (#2077) The generated PluginVersion/ThemeVersion specs iterate over every slug in the fixture DB (~35k examples), all tagged as slow so they only run in the full suite on master. PR checks run... push 23 Jul 2026 02:56PM UTC web-flow github
95.04
30014813059 master Bump WPScan version to 4.1.0. (#2078) push 23 Jul 2026 02:53PM UTC web-flow github
95.04
30014052465 bump-version-4-1-0 Merge 7acaccfbf into d4e6b65bc Pull #2078 23 Jul 2026 02:07PM UTC web-flow github
95.04
30012944951 test/stable-coverage-for-dynamic-finder-specs Merge cadd65299 into 77915f638 Pull #2077 23 Jul 2026 01:54PM UTC web-flow github
95.04
30002642944 master Fix SimpleCov 1.0 deprecation warnings (#2076) - Make .simplecov configuration-only (SimpleCov.configure) and move the SimpleCov.start call into spec/spec_helper.rb - Replace deprecated add_filter with skip - Replace # :nocov: markers with # si... push 23 Jul 2026 12:00PM UTC web-flow github
95.04
30000446734 master Add opt-in local vulnerability database support (--enterprise-db-token) (#2073) * Add opt-in local vulnerability database support via --enterprise-db-token Enterprise customers can now scan using a local vulnerability database dump instead of th... push 23 Jul 2026 11:23AM UTC web-flow github
95.49
See All Builds (1544)
  • Repo on GitHub
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE TRIAL · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc