== Changelog ==

= [5.0.1] - 2026-06-02 =

**Fixed**

* `wp_cache_flush()` removed from `wpvulnerability_update_database_data()` and `wpvulnerability_reset_plugin_data()`. The function was wiping the entire Object Cache (Redis, Memcached, APCu) on every plugin or theme update, causing CPU spikes and database overload on high-traffic sites. The targeted `wpvulnerability_delete_transients()` call that already runs before it invalidates all plugin-owned cache entries; a global flush was never necessary.
* `wp_cache_flush()` was called twice on plugin reset: once inside `wpvulnerability_update_database_data()` and once more immediately after in `wpvulnerability_reset_plugin_data()`. Both calls have been removed.

= [5.0.0] - 2026-05-26 =

**Added**

* Vulnerability detail panels fully redesigned across all contexts (plugins, themes, core, server software, Site Health):
  * Bootstrap-inspired score/severity badge colour-coded by severity level (Critical/High/Medium/Low/None).
  * Source attribution pills: label is the hostname extracted from the source URL (e.g. `wordfence.com`, `nvd.nist.gov`); uniform dark-grey `#50575e`; hover turns black/white; linked with `rel="nofollow noopener noreferrer"`.
  * "References:" label and pills displayed on the same flex row.
  * CVSS priority order: CVSS 4 → CVSS 3 → CVSS 2 → legacy CVSS. The highest available score and severity are always shown.
  * `ssvc.exploitation`: `poc` → "⚡ Public exploit" badge; `active` → merged into "⚠ Actively exploited".
  * `ssvc.automatable: yes` → "⚙ Automatable" badge.
  * `ssvc.kev_date` → date appended to "Actively exploited" (e.g. "⚠ Actively exploited · 2024-03-15").
  * `epss` → "EPSS X.X%" badge on the same row as the CVSS badge.
  * CVE description from `source[].description` shown for all vulnerability types; `[en-US]` / language prefix stripped automatically.
  * CWE name and description shown in server software vulnerability details (was missing).
  * Version range: leading `-` / `*` stripped when there is no lower bound (e.g. `- < 1.3.28` → `< 1.3.28`).
  * Wording change: "affecting this version" → "affecting your installed version" (plugins, themes, core).
* Core vulnerabilities on `update-core.php`: display rewritten to use the same two-column table with badges, description, CWE, and reference pills as plugin/theme rows (replaces the old plain table with score-only rows).
* Theme details modal (single-site): vulnerability section injected after the Tags field. Uses `wp_prepare_themes_for_js` filter to embed pre-rendered HTML and a JS template patch (`admin_footer`) to surface it inside the Underscore.js template. Shows version range, badges, description, and references — identical layout to plugin rows.
* Helper functions added to `wpvulnerability-process.php`: `wpvulnerability_source_css_slug()`, `wpvulnerability_render_source_pills()`, `wpvulnerability_render_score_badge()`, `wpvulnerability_clean_version_range()`, `wpvulnerability_get_source_description()`.
* Helper functions added to `wpvulnerability-themes.php`: `wpvulnerability_theme_modal_html()`, `wpvulnerability_filter_prepare_themes_for_js()`, `wpvulnerability_theme_modal_template_patch()`.
* Vulnerability severity now uses the full-word value from `cvss3.severity` (`"critical"`, `"high"`, `"medium"`, `"low"`, `"none"`) when available, falling back to the legacy single-character `cvss.severity` code. `wpvulnerability_severity()` accepts both formats.
* Known Exploited Vulnerability (KEV) badge: when a vulnerability is listed in the CISA KEV catalog (`impact.ssvc.kev: true` for plugins/themes/core; `impact.kev: true` for server software), a prominent warning is shown in the vulnerability detail panel.
* Publication date displayed next to each source link in the vulnerability details table (`source[].date` field from the API).
* Server software lifecycle status displayed in the vulnerability detail panel: a coloured dot shows whether the detected version is **Supported** or **End of Life**, together with the end-of-life date if available (`data.status`, `data.date_end` fields from the API).
* EOL badge shown in the dashboard software grid (PHP, Apache, nginx, MariaDB, MySQL, ImageMagick, curl, memcached, Redis, SQLite) when the detected version has reached end-of-life. Lifecycle data is fetched alongside vulnerability data during the scheduled scan and stored with the software option.
* REST API: all vulnerability endpoints now expose `uuid` (unique vulnerability identifier), `kev` (boolean), `ssvc` block (`exploitation`, `automatable`, `technical_impact`) for plugins/themes/core, and `severity` from `cvss3` when available.
* About tab: new **Intelligence Sources** table showing how many vulnerabilities each source (CVE, EUVD, JVN, Patchstack, WPScan, Wordfence) contributes, broken down by Core / Plugins / Themes. Populated from the new `stats.vulnerabilities.{source}` field in the API.
* REST API: source entries now include a `date` field with the vulnerability publication date.

**Security**

* `wpvulnerability-adminms.php`: `wpvulnerability_process_network_config_forms()` now requires `manage_network_options` capability (via `current_user_can()`) in addition to the nonce check already present. Previously, a logged-in user who obtained a valid nonce could update plugin config and analysis options.
* WP-CLI: all vulnerability commands (`core`, `plugins`, `themes`, `php`, `apache`, …) now require `manage_options` (or `manage_network_options` on multisite). Commands abort with a clear error and `--user=<admin_login>` hint if the check fails. Enforces the same access model as the REST API endpoints.
* WP-CLI: all config commands (`hide`, `email`, `cache`, `log-retention`, `period`) now require `manage_options` / `manage_network_options` before modifying any WordPress option.
* REST API permission check now passes strict mode (`true`) to `base64_decode()` when parsing the HTTP Basic Authorization header. Without this flag, PHP silently ignores illegal base64 characters; with it, a malformed or padding-stripped token is immediately rejected and returns an authentication failure instead of decoding unpredictable bytes.
* Debug web server detection (LiteSpeed, OpenLiteSpeed, Caddy) now routes through the `wpvulnerability_safe_shell_exec()` wrapper instead of calling `shell_exec()` directly. This ensures the `WPVULNERABILITY_DISABLE_SHELL_EXEC` constant, the security mode, the command whitelist, and audit logging are respected even when `WP_DEBUG` is enabled.

**Fixed**

* Forced test email on a fresh install (no email address configured yet) no longer produces an `E_WARNING` on PHP 7.x or a `TypeError` on PHP 8.x. The fallback now initialises `emails` as an array instead of appending to a potentially empty string.
* `determine_locale()` call in the About tab is now guarded by `function_exists()` instead of a `version_compare()` check, which is more forward-compatible and correctly recognised by static analysis tools.
* `preg_replace()` return values (which can be `null` on error) in the HTML-to-plain-text converter are now handled safely, preventing a potential `TypeError` on corrupt input.
* `DOMDocument::$documentElement` null check added in the HTML-to-plain-text converter; avoids a potential fatal error on malformed or empty HTML fragments.
* JSON-encoded vulnerability count options are validated as strings before being passed to `json_decode()`, preventing potential errors when a WordPress option returns an unexpected type.
* `cron_schedules` callbacks (`wpvulnerability_add_every_week`, `wpvulnerability_add_every_day`) now use `did_action('init')` guard before calling `__()`, eliminating the "Translation loading triggered too early" notice introduced in WordPress 6.7.
* WP-CLI vulnerability commands (`core`, `plugins`, `themes`, `php`, and all software components) now display a clear success message when no vulnerabilities are found, instead of an empty table.
* WP-CLI `config period monthly` now returns a proper error message instead of silently treating the value as `never`. Valid periods are `daily`, `weekly`, and `never`.
* `uninstall.php` created. Plugin data is preserved by default on uninstall; a new "Delete all plugin data on uninstall" checkbox in the Tools settings tab allows opting in to full removal.
* Large vulnerability data options are now stored with `autoload=false`, preventing unnecessary loading of JSON blobs on every WordPress request.

**Changed**

* Minimum required PHP version updated from 5.6 to 7.0. The null coalescing operator (`??`) introduced throughout the codebase for improved type safety requires PHP 7.0 or later. PHP 5.6 reached end-of-life in December 2018 and is no longer supported by any currently maintained WordPress version.
* Minimum required WordPress version updated from 4.7 to 5.6. This enables simplification of backward-compatibility code paths and full use of Application Passwords, `wp_timezone()`, `wp_date()`, `determine_locale()`, and `$wpdb->db_server_info()` without version guards.
* Removed `wp_doing_cron()` polyfill — the function has been available since WordPress 4.8 and is guaranteed at the new minimum.
* Application Passwords authentication in the REST API no longer requires a `function_exists('wp_is_application_passwords_available')` guard — Application Passwords are always available at WordPress 5.6.
* Removed fallback code paths for `wp_timezone()` (WordPress 5.3), `wp_date()` (WordPress 5.3), and `determine_locale()` (WordPress 5.0).
* `wpvulnerability_get_vulnerabilities()` now stores the `impact` field in each matched vulnerability array entry, enabling KEV and severity display for all component types.
* `wpvulnerability_get_fresh_vulnerabilities()` (software.php) now stores lifecycle metadata (`name`, `status`, `date_start`, `date_end`) in the software option alongside `vulnerabilities` and `vulnerable`. The transient is explicitly cleared before the refresh to guarantee a fresh API call.
* `wpvulnerability_get_cron_snapshot()` now uses only public WordPress Cron API functions (`wp_next_scheduled()`, `wp_get_schedule()`) instead of the private `_get_cron_array()`. The function iterates over the known plugin hooks (defined in `wpvulnerability_get_plugin_cron_hooks()`) rather than scanning the full cron array. Duplicate-instance detection is no longer performed.
* `wpvulnerability_get_plugin()`, `wpvulnerability_get_theme()`, `wpvulnerability_get_core()`, and `wpvulnerability_get_vulnerabilities()` now store the `uuid` field in each vulnerability entry.

**Developer**

* Full PHPStan level 9 compliance achieved across all 17 PHP files: 1,092 pre-existing type errors resolved; analysis now passes clean with zero errors and an empty baseline.
* Added development tooling: `composer.json` with all dev dependencies, `phpstan.neon` (level 9), `phpcs.xml` (WordPress standards), `phpunit.xml.dist`, `bin/deploy.sh`, and `docs/` directory.
* Added 18 PHPUnit plugin header tests verifying consistency between `wpvulnerability.php` and `readme.txt`.
* WordPress API stubs updated to v7.0.0 for PHPStan analysis. Added `johnbillion/wp-compat` extension for WordPress version compatibility analysis.
* Added internal helpers `wpvulnerability_get_component_count()` and `wpvulnerability_get_config()` to centralise typed access to cached vulnerability counts and plugin configuration.
* Fixed 10 WordPress version compatibility findings reported by `wp-compat`: `wp_date()`, `determine_locale()`, `wp_authenticate_application_password()`, `after_core_auto_updates_settings` hook, `site_status_tests` filter, and others.

**Compatibility**

* WordPress: 5.6 - 7.1
* PHP: 7.0 - 8.5
* WP-CLI: 2.3.0 - 2.12.0

**Tests**

* PHP Coding Standards: 3.13.5
* WordPress Coding Standards: 3.3.0
* PHPStan: 2.1.55 (level 9, 0 errors)
* PHPUnit: 9.6.34 (18 tests)
* Plugin Check (PCP): 1.8.0

= [4.3.2] - 2026-05-20 =

**Performance**

* Notification scheduling no longer rewrites the `cron` row in `wp_options` on every WordPress request. The boot-time call to `wpvulnerability_schedule_notification_event()` now checks the current schedule with `wp_get_schedule()` and only clears/reschedules the `wpvulnerability_notification` event when the desired period actually differs from what is already scheduled. This mirrors the idempotent pattern already used by `wpvulnerability_schedule_core_events()` and eliminates 1-2 unnecessary `UPDATE wp_options` queries per page load, reducing lock contention under concurrent load (PHP-FPM workers / bots) and removing the corresponding entries from the MariaDB/MySQL slow query log.

**Changed**

* `wpvulnerability_schedule_notification_event( $config )` gained an optional second parameter `$force` (default `true`, backwards compatible). When called with `$force = false`, the function returns early if the current cron schedule for `wpvulnerability_notification` already matches the desired period derived from `$config`. All existing callers (admin save handlers in `wpvulnerability-admin.php` and `wpvulnerability-adminms.php`, the WP-CLI config command in `class-wpvulnerability-config-cli.php`, the update flow in `wpvulnerability-run.php`, and the repair helpers `wpvulnerability_repair_cron_events()` / `wpvulnerability_repair_network_cron_events()`) continue to force an unconditional reschedule, ensuring that hour/minute/day changes still update the next-run timestamp.

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.5
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.5
* WordPress Coding Standards: 3.3.0
* Plugin Check (PCP): 1.8.0

= [4.3.1] - 2026-01-20 =

**Fixed**

* Dashboard widget now correctly counts only vulnerabilities from enabled components, excluding disabled ones from settings.
* Status badge calculation (Critical/Warning) now properly considers only enabled components when determining severity level.
* Fixed PHPCS warnings for global variables without plugin prefix in wpvulnerability-admin.php and wpvulnerability-adminms.php.

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.5
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.5
* WordPress Coding Standards: 3.3.0
* Plugin Check (PCP): 1.8.0

= [4.3.0] - 2026-01-19 =

**Highlights**

This major release brings a complete redesign of the admin interface, comprehensive debugging tools, enhanced security, and new notification channels.

* **Complete Admin Interface Redesign**: Modern card-based layout with visual component cards, improved spacing, color-coded status badges, and responsive grid layouts across all Settings tabs (Security, About, Logs, Tools, Analysis, and Notifications).
* **New Debug Mode**: Comprehensive debugging tools visible when WP_DEBUG is enabled, including System Information, Component Detection with cache status, interactive API Testing with AJAX buttons, Configuration Summary, Cron Status with manual execution, Database Options Viewer, and Quick Actions (clear caches, reset signatures, export debug data as JSON). Includes enhanced web server detection for 9 different servers.
* **Dashboard Widget Redesign**: Modern interface with prominent status badges (All Clear/Issues Found/Critical Issues Found), last check timestamp with human-readable format, empty state display with centered checkmark, separated component sections (WordPress Components vs Server Software), color-coded badges, and 2-column grid layout for server software.
* **New Notification Channels**: Discord webhook support and Telegram bot integration for vulnerability notifications, with proper character limit handling and webhook URL validation.
* **Enhanced Security**: CSRF protection via nonces for plugin/theme vulnerability filters, hybrid software detection system (PHP extensions first, shell commands as fallback), complete audit logging for shell executions, webhook URL validation with HTTPS enforcement and domain whitelisting, and new wp-config.php security constants.
* **Multisite Improvements**: Fixed all form submission issues in Network Admin, proper nonce handling, correct URL generation with network_admin_url(), preserved settings when saving individual forms, and fixed Security tab with all required helper functions.
* **Tools & Maintenance**: Cron event repair functionality for single sites and multisite networks, "Delete all logs" button, full plugin reset action, and improved cache management.

**Added**

* Tools tab now lists expected WPVulnerability cron events, shows the scheduled instances, and lets administrators repair them on single sites.
* Network Tools highlights unexpected WPVulnerability cron events on subsites and provides a one-click repair to clear and reschedule across the network.
* Logs tab now includes a "Delete all logs" button to purge stored API log entries manually.
* Hybrid software detection system: PHP extensions first (most secure), shell commands fallback (most accurate).
* Four-level security control system for shell_exec usage with granular configuration.
* Shell command validation with whitelist and dangerous pattern detection.
* Complete audit logging for all shell executions (component, command, output, user, IP, timestamp).
* New wp-config.php constants: `WPVULNERABILITY_DISABLE_SHELL_EXEC`, `WPVULNERABILITY_SECURITY_MODE`, `WPVULNERABILITY_SHELL_EXEC_WHITELIST`.
* Detection reliability scoring (0-100) for each software detection method.
* Discord webhook support for vulnerability notifications with 2000-character limit handling.
* Telegram bot support for vulnerability notifications with bot token and chat ID configuration.
* Documentation links for Discord webhook setup (https://support.discord.com/hc/articles/228383668).
* Documentation links for Telegram bot setup (https://core.telegram.org/bots).
* Debug tab (visible only when WP_DEBUG is enabled) providing comprehensive debugging tools for administrators.
* wpvulnerability-debug.php file with 11 helper functions for debug functionality (~18KB).
* Debug Section 1: System Information displaying WordPress version, PHP version/extensions/memory, database type (MariaDB vs MySQL with proper detection), web server (nginx/Apache/LiteSpeed/OpenLiteSpeed/Caddy/IIS/Angie/OpenResty/Tengine), debug modes status, and debug log file information.
* Debug log file information showing file path, size, and direct browser link when web-accessible.
* Debug Section 2: Component Detection table listing all 13 components with detection status, version, analyzed state, and cache expiration time.
* Debug Section 3: API Testing with interactive AJAX-powered buttons to test API connectivity for each component individually, showing HTTP status, response time, and data preview.
* Debug Section 4: Configuration Summary displaying current plugin settings at a glance.
* Debug Section 5: Cron Status showing scheduled tasks with manual execution buttons (permission-gated with nonce verification).
* Debug Section 6: Database Options Viewer with dropdown to inspect all stored plugin options.
* Debug Section 7: Quick Actions with buttons to clear all caches, reset plugin/theme signatures, and export debug information as JSON.
* Enhanced web server detection supporting 9 different servers: nginx, Angie (nginx fork), Apache, LiteSpeed, OpenLiteSpeed, Caddy, IIS, OpenResty (nginx-based), and Tengine (nginx fork).
* Three-level detection logic for web servers: (1) plugin's standard function, (2) SERVER_SOFTWARE parsing, (3) shell commands as fallback.
* Database detection properly distinguishes MariaDB from MySQL via version_comment SQL query.
* AJAX handler `wpvulnerability_ajax_test_api()` for API testing with nonce verification and capability checks.
* Debug helper functions: `wpvulnerability_debug_get_log_file_info()`, `wpvulnerability_debug_detect_webserver()`, `wpvulnerability_debug_get_system_info()`, `wpvulnerability_debug_get_component_status()`, `wpvulnerability_debug_test_api_component()`, `wpvulnerability_debug_get_cron_status()`, `wpvulnerability_debug_export_info()`, `wpvulnerability_debug_clear_all_caches()`, `wpvulnerability_debug_reset_signatures()`, `wpvulnerability_debug_get_option_names()`.
* Debug tab POST handlers in both wpvulnerability-admin.php and wpvulnerability-adminms.php with nonce verification for all actions.
* Debug tab render functions in wpvulnerability-admin.php: `wpvulnerability_render_admin_tab_debug()`, `wpvulnerability_render_debug_section_system_info()`, `wpvulnerability_render_debug_section_components()`, `wpvulnerability_render_debug_section_config()`, `wpvulnerability_render_debug_section_cron()`, `wpvulnerability_render_debug_section_api_testing()`, `wpvulnerability_render_debug_section_database_options()`, `wpvulnerability_render_debug_section_quick_actions()`.

**Security**

* Added CSRF protection via nonces for plugin vulnerability filter links to prevent forced navigation attacks.
* Added CSRF protection via nonces for theme vulnerability filter links to prevent forced navigation attacks.
* Plugin and theme filter URLs now include security nonces that are verified before applying filters.
* Enhanced security against timing attacks on vulnerability enumeration by requiring valid nonces.
* Enhanced ImageMagick, Redis, Memcached, and SQLite detection with hybrid approach and security controls.
* All shell commands hardcoded and validated - no user input involved.
* Shell execution wrapper with complete security checks and logging.
* Webhook URLs now validated on save: enforces HTTPS and verifies hostname matches allowed domains (Slack: hooks.slack.com, Teams: office.com/office365.com/api.hooks.microsoft.com, Discord: discord.com/discordapp.com).
* Telegram bot token validation with regex pattern check (format: 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11).
* Invalid webhook URLs and bot tokens are rejected with user-friendly error messages instead of silently failing on notification send.
* Security audit score improved from 85/100 to 98/100 (comprehensive security audit completed 2026-01-19).

**Changed**

* Database error hook now fires the prefixed `wpvulnerability_wpdb_last_error` action while keeping the legacy hook deprecated.
* Database update cron now follows the configured cache duration (hourly, 6h, 12h, or 24h).
* Translations load on init to avoid early textdomain warnings.
* Vulnerability data now refreshes only via scheduled cron or the manual reload action; admin requests, REST, CLI, notifications, and view rendering no longer trigger API calls to reduce load.
* Cron scheduling no longer re-queues the update event on every page load; it keeps the configured interval (hourly/6h/12h/24h) unless the schedule changes.
* REST API now requires administrator capabilities for session or application password access.
* Admin reset and test email actions enforce admin capabilities.
* API client timeouts corrected to 2.5 seconds to avoid long hangs.
* Slack/Teams webhooks restricted to allowed HTTPS hosts to limit SSRF exposure.
* Tools tab adds a full reset action that clears all plugin data, restores defaults, and reloads from the API.
* Complete redesign of the admin settings interface with modern card-based layout for all tabs: Security, About, Logs, Tools, Analysis, and Notifications.
* Settings tabs now feature visual component cards with icons, improved spacing, color-coded status badges, and responsive grid layouts for enhanced usability.
* Complete redesign of the Dashboard widget with modern, clean interface replacing the basic list layout.
* Dashboard widget now features prominent status badge with three states: "All Clear" (green, 0 vulnerabilities), "X Issues Found" (yellow, minor issues), "X Critical Issues Found" (red, Core/PHP vulnerable or 5+ total vulnerabilities).
* Dashboard widget displays last check timestamp with human-readable format ("X minutes ago", "X hours ago") and "Refresh Now" link.
* Dashboard widget shows attractive empty state with centered green checkmark when no vulnerabilities are detected.
* Dashboard widget separates components into two clear sections: "WordPress Components" (Core, Plugins, Themes) and "Server Software" (PHP, web server, database, etc.).
* Dashboard widget uses color-coded badges: green for secure (✓ 0), yellow/red for vulnerabilities (✕ N) with consistent design.
* Dashboard widget displays server software in 2-column grid layout for better space utilization.
* Dashboard widget shows vulnerable plugin/theme lists indented below their respective components.
* Dashboard widget uses inline CSS with modern styling: flexbox layouts, proper spacing, WordPress admin color palette, improved typography (13px components, 12px meta).
* Dashboard widget footer includes links to Site Health and Settings with visual separation.
* All CSS class names, HTML IDs, and JavaScript references changed from short prefix `.wpv-` to full prefix `.wpvulnerability-` to prevent naming conflicts with other plugins and themes (affects 73+ unique classes across admin panels).
* All inline CSS from admin panels moved to external assets/admin.css file for better performance and cacheability (~1084 lines extracted from 14 style blocks across single-site and multisite admin panels).
* License updated from GPL2+ to GPL3+.

**Fixed**

* Saving partial forms (e.g., log retention) no longer resets other notification settings to their defaults; existing values are preserved unless explicitly changed.
* Network (adminms) settings now preserve existing values when saving individual forms and keep notification scheduling consistent.
* Cache column in Component Detection (Debug tab) now correctly displays cache expiration time by properly decoding JSON-encoded timestamps from database.
* Database detection now properly distinguishes between MariaDB and MySQL instead of always showing "MySQL".
* Multisite network admin forms (Notifications, Analysis, Configuration) now submit correctly by using proper network admin URLs and nonces instead of incompatible Settings API methods.
* All form submission buttons in multisite admin now include proper `name` attribute (`wpvulnerability_submit`) for backend processing.
* Delete logs form in multisite now uses `network_admin_url()` instead of single-site `admin_url()` for correct URL generation.
* All multisite form nonce verifications now match their corresponding form nonce fields (reset, email, repair cron, delete logs) instead of using generic nonce.
* Security tab in multisite network admin now works correctly by including all required helper functions (wpvulnerability_display_security_status, wpvulnerability_display_detection_methods, wpvulnerability_display_security_logs) instead of calling undefined single-site functions.
* Tools tab buttons in multisite network admin no longer show "nonce expired" errors by submitting forms to the same page (action="") instead of explicit URL paths that fail referer validation.
* Delete All Logs button in Logs tab no longer shows "The link you followed has expired" error by using empty form action (action="") in both single-site and multisite admin panels.
* Logs tab pagination now displays horizontally instead of vertically by properly targeting list elements (ul with inline-flex) and individual page links (a and span within li) to work correctly with WordPress paginate_links() 'type' => 'list' output.

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.5
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.5
* WordPress Coding Standards: 3.3.0
* Plugin Check (PCP): 1.8.0

= [4.2.1.1] - 2026-01-16 =

**Security**

* Fixed authorization vulnerability in REST API endpoints that allowed low-privileged users to access sensitive vulnerability data. API now properly verifies user capabilities (`manage_options` for single sites, `manage_network_options` for multisite) in addition to authentication.
* Added direct access protection to wpvulnerability-api.php to prevent direct file execution outside WordPress context.

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.5
* WordPress Coding Standards: 3.3.0
* Plugin Check (PCP): 1.8.0

= [4.2.1] - 2025-12-17 =

**Fixed**

* Clear legacy WPVulnerability cron events from multisite subsites so updates and log cleanup only run on the main site.

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.5
* WordPress Coding Standards: 3.3.0
* Plugin Check (PCP): 1.7.0

= [4.2.0] - 2025-12-16 =

**Added**

* GUI reorganized with tabs.
* New log tab, listing API calls made in the last days.
* Added some tests to check email.
* Constant `WPVULNERABILITY_LOG_RETENTION_DAYS` to enforce log rotation from `wp-config.php`.
* WP-CLI command to configure log retention from the terminal.
* Automated pruning of stored logs based on the configured retention window.

**Updated**

* New logo and assets.
* PHP syntax to avoid errors.
* Access level control in all the options.
* Uninstall deletes everything.
* POT (translations) file.
* Software versions detection.
* Documentation improvements.
* Improved the content for Slack and Microsoft Teams notifications (in a more old-fashion way).
* Fine-tuned settings labels to reflect enforced log retention values when the constant is present.

**Fixed**

* Mail unsubscription.
* Mail sending failed.
* Enforced the cache (a lot).
* Core versions (beta and RC) with invalid format.
* Normalize stored notification preferences to avoid stale values after upgrades.

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.4
* WordPress Coding Standards: 3.2.0
* Plugin Check (PCP): 1.6.0
* SonarCloud Code Review
* Amplify Code Check

= [4.1.1] - 2025-09-22 =

**Fixed**

* Fix an error with the version_compare() (thx to @konnektiv)

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.4
* WordPress Coding Standards: 3.2.0
* Plugin Check (PCP): 1.6.0
* SonarCloud Code Review
* Amplify Code Check

= [4.1.0] - 2025-09-16 =

**Added**

* "Never" send notifications.
* Choose notification day and time.
* Configurable cache expiration (1, 6, 12 or 24 hours).
* WP-CLI command to configure cache expiration.
* Constants to set hiding components.
* WP-CLI command to manage hidden components.
* WP-CLI command to configure notification email and period.
* Add notifications for Slack and Teams.
* Disable mail notifications from mails.
* WordPress Playground blueprint (in test).

**Changed**

* Cache is always the same eveywhere.
* Options for notifications.
* Schedule fields only appear for selected periods.
* Placeholder and conditional display for Slack and Teams notification fields.
* Added links to documentation.

**Fixed**

* When a plugin is updated, hide the vulnerabilities.
* Display of schedule fields based on period.
* Conditional display for email, Slack, and Teams notification fields.
* When save, there where two saving messages.
* wp_get_update_php_url() for WordPress 5.1.0+ (fallback)
* wp_timezone() for WordPress 5.1.0+ (fallback)
* wp_doing_cron() for WordPress 4.8.0+ (fallback)
* Application Passwords / REST API after WordPress 5.6.0

**Compatibility**

* WordPress: 4.7 - 6.9
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.13.4
* WordPress Coding Standards: 3.2.0
* Plugin Check (PCP): 1.6.0
* SonarCloud Code Review
* Amplify Code Check

= [4.0.4] - 2025-04-07 =

**Added**

* Extra sanitizations.

**Changed**

* Translation improvements.

**Fixed**

* Plugin and translation load.

**Compatibility**

* WordPress: 4.1 - 6.8
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.12.1
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.4.0
* SonarCloud Code Review

= [4.0.3] - 2024-10-28 =

* Recreation of the 4.0.2 version. Something did not created the 4.0.2 version.

= [4.0.2] - 2024-10-25 =

**Fixed**

* ImageMagick: it crashes in some cases where the hosting does not have ImageMagick.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.10.3
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.1.0
* SonarCloud Code Review

= [4.0.1] - 2024-10-04 =

**Fixed**

* API endpoints: some API endpoints were failing.
* CLI endpoints: some CLI endpoints were failing.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.10.3
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.1.0
* SonarCloud Code Review

= [4.0.0] - 2024-10-01 =

**Added**

* ImageMagic vulnerabilities (Site Health + WP-CLI + API + mail).
* curl vulnerabilities (Site Health + WP-CLI + API + mail).
* memcached vulnerabilities (Site Health + WP-CLI + API + mail).
* Redis vulnerabilities (Site Health + WP-CLI + API + mail).
* SQLite vulnerabilities (Site Health + WP-CLI + API + mail).

**Fixed**

* Test email without email.
* Improved MariaDB 11.x detection.
* Improved versions detection (major-minor.patch-build).
* WordPress < 5.3: use of wp_date().
* WordPress < 5.0: locale detection.
* Dashboard widget only for users with capabilities.
* WordPress < 5.2: link to Site Health

**Changed**

* Big refactory.
* Less files, less size, improved code quality.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.4
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* Manual Testing:
  * WordPress 6.7 / PHP 8.4
  * WordPress 6.6 / PHP 8.3
  * WordPress 6.4 / PHP 8.2
  * WordPress 6.1 / PHP 8.1
  * WordPress 5.8 / PHP 8.0
  * WordPress 5.5 / PHP 7.4
  * WordPress 5.3 / PHP 7.3
  * WordPress 4.9 / PHP 7.2
  * WordPress 4.8 / PHP 7.1
  * WordPress 4.6 / PHP 7.0
  * WordPress 4.1 / PHP 5.6
* PHP Coding Standards: 3.10.3
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.1.0
* SonarCloud Code Review

= [3.4.1] - 2024-08-23 =

**Fixed**

* The number of vulnerabilities for core is incorrect.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.4.0] - 2024-08-16 =

**Added**

* New checks for MariaDB vulnerabilities.
* New checks for MySQL vulnerabilities.
* WPVulnerability statistics in the configuration page.
* WPVulnerability contributors in the configuration page.

**Changed**

* Code improvement.
* Better UI for the configuration page.
* Web server version detection improved.

**Fixed**

* Get the statistics information the right way.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.3.5] - 2024-08-14 =

**Added**

* Add counters for Core, Plugins, and Themes.
* Add a Vulnerabilities filter in the Plugin list (WordPress and WordPress Multisite).
* Add a Vulnerabilities filter in the Themes list (WordPress Multisite).

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.3.4] - 2024-08-12 =

**Fixed**

* The "Last updated on" column in the plugin list is available again.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.11.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.3.3] - 2024-08-05 =

**Fixed**

* The Dashboard panel is availbale, again.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.10.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.3.1] - 2024-08-02 =

**Fixed**

* Delete the wp_is_rest_endpoint check. Does not need it.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.10.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.3.0] - 2024-08-02 =

**Added**

* Ability to exclude of vulnerability types at a global level.
* WP-CLI commands formats (--format=[table,json]).
* REST API endpoints (requires Application Password).

**Changed**

* README file.

**Compatibility**

* WordPress: 4.1 - 6.7
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.10.0

**Tests**

* PHP Coding Standards: 3.10.2
* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.2.2] - 2024-07-27 =

**Added**

* Ability to configure a different From: email address for sending vulnerability notifications via `wp-config.php`.

**Changed**

* The URL for the website now uses its own domain name.
* Dashboard visibility is restricted to users with specific capabilities, similar to Site Health.

**Fixed**

* Various minor fixes to prevent warnings and potential errors due to misconfigured WordPress setups.
* Allow loading of some necessary libraries.

**Compatibility**

* WordPress: 4.1 - 6.6
* PHP: 5.6 - 8.3
* WP-CLI: 2.3.0 - 2.10.0

**Tests**

* WordPress Coding Standards: 3.1.0
* Plugin Check (PCP): 1.0.2
* SonarCloud Code Review

= [3.2.0] - 2024-05-08 =

**Added**

* Apache HTTPD vulnerabilities (Site Health).
* nginx vulnerabilities (Site Health).

**Changed**

* License updated to GPL 2.0 or later.

**Compatibility**

* WordPress 4.1 - WordPress 6.6.
* PHP 5.6 - PHP 8.3.
* WordPress Coding Standards 3.1.0.
* WP-CLI 2.3.0 - WP-CLI 2.10.0.
* Plugin Check (PCP)

= [3.1.2] - 2024-05-08 =

**Fixed**

* In some cases (when calling it directly, or wget), the cron was not working and gave an error.
* The license had a non-compliance ID. Now, same license but working.
* General improvements.

**Changed**

* The URL from the API is using its own domain name.

**Compatibility**

* WordPress 4.1 - WordPress 6.6.
* PHP 5.6 - PHP 8.3.
* WordPress Coding Standards 3.1.0.
* WP-CLI 2.3.0 - WP-CLI 2.10.0.
* Plugin Check (PCP)

= [3.1.1] - 2024-02-11 =

**Fixed**

* Fixes some possible PHP warnings when retrieving data from the API.
* Delete old schedules when unistalling the plugin.
* Fix how is printed the High severity.

**Deleted**

* The plugin will not show the Exploitability information.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.5.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.1.
* Compatibility: WP-CLI 2.3.0 - WP-CLI 2.10.0.

= [3.1.0] - 2024-02-04 =

**Added**

* A new column in the plugin list, with the last updated day (and diff).
* A notice if the plugin is closed in the WordPress.org repo.

**Fixed**

* Fixes the schedule in some cases.
* Fixes the PHP format (using always the n.n / n.n.n format).

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.5.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.1.
* Compatibility: WP-CLI 2.3.0 - WP-CLI 2.9.0.

= [3.0.2] - 2024-01-27 =

**Fixed**

* Fixes the WordPress Multisite saving options.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.5.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.1.
* Compatibility: WP-CLI 2.3.0 - WP-CLI 2.9.0.

= [3.0.1] - 2023-12-19 =

**Fixed**

* Test email with the actual vulnerabilities (or a test message), now forced when the button is clicked.
* Fixed some strings (thanks @alexclassroom).
* WordPress Coding Standards 3.0.1 up-to-date.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.4.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.1.
* Compatibility: WP-CLI 2.3.0 - WP-CLI 2.9.0.

= [3.0.0] - 2023-12-09 =

**Added**

* WordPress Multisite support.
* PHP vulnerabilities (Site Health).
* Reload the data from source.
* Test email with the actual vulnerabilities.

**Changed**

* Loading the data in better way.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.4.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.1.
* Compatibility: WP-CLI 2.3 - WP-CLI 2.9.0.

= [2.2.1] - 2023-10-02 =

**Added**

* New security information (at WordPress.org plugin page).
* New privacy information (at WordPress.org plugin page).
* New compatibility information (at WordPress.org plugin page).
* New vulnerabilities information (at WordPress.org plugin page).
* New profiling information (at WordPress.org plugin page).

**Changed**

* Promoted dashboard.
* Performance improvement: only load the plugin in the admin area.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.4.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.1.
* Compatibility: WP-CLI 2.3 - WP-CLI 2.8.1.

= [2.2.0] - 2023-09-14 =

**Added**

* New Dashboard, with a Vulnerability summary and products affected.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.3.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.0.
* Compatibility: WP-CLI 2.3 - WP-CLI 2.8.

= [2.1.0] - 2023-09-11 =

**Changed**

* Improved detection of plugins folders. This shpould reduce the false positives in some plugins, and Pro/Premium plugins.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.3.
* Compatibility: PHP 5.6 - PHP 8.3.
* Compatibility: WordPress Coding Standards 3.0.0.
* Compatibility: WP-CLI 2.3 - WP-CLI 2.7.

= [2.0.4] - 2023-09-10 =

**Compatibility**

* WordPress Coding Standards 3.0.0 compatible.

= [2.0.3] - 2023-07-27 =

**Added**

* Validate secure requests to the API.

**Changed**

* Reduce API timeout request time from 10.0 seconds to 2.5 seconds.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.3.
* Compatibility: PHP 5.6 - PHP 8.3.

= [2.0.2] - 2023-04-24 =

**Fixed**

* Fix the Notification system.

= [2.0.1] - 2023-04-20 =

**Added**

* Added new options to cache the vulnerability counter.

**Changed**

* Update the readme.txt.

**Fixed**

* Fix the Site Health messages.

= [2.0.0] - 2023-04-15 =

**Added**

* If the WordPress version supports it, vulnerabilities are displayed in the Core update screen.
* Calls can be made from WP-CLI `wp help wpvulnerability` to list vulnerabilities in Core `wp wpvulnerability core`, Plugins `wp wpvulnerability plugins` and Themes `wp wpvulnerability themes`. Before only Plugins.
* Site Health shows core vulnerabilities, which were not previously shown.

**Changed**

* The plugin has been completely refactored.

**Compatibility**

* Compatibility: WordPress 4.1 - WordPress 6.2
* Compatibility: PHP 5.6 - PHP 8.2
* Compatibility: WP-CLI 2.3 - 2.7

= [1.3.2] - 2023-03-22 =

**Changed**

* Code security improvements

**Fixed**

* Fix some PHP errors

= [1.3.2] - 2023-03-22 =

**Changed**

* Code security improvements

**Fixed**

* Fix some PHP errors

= [1.3.1] - 2023-02-27 =

**Changed**

* Code security improvements
* Fix the Severity value
* A better Site Health information

**Compatibility**

* Compatibility: WordPress 5.2 - WordPress 6.2
* Compatibility: PHP 7.2 - PHP 8.1

= [1.3.0] - 2023-02-27 =

**Added**

* Information, when available, about the vulnerability, in a simplified way. Only in the plugin list.
* Information, when available, about the potential severity and exploitability. Only in the plugin list.
* Links to sources to get additional information. Only in the plugin list.

**Changed**

* Improved security in code.

= [1.2.4] - 2023-02-20 =

**Compatibility**

* Compatibility: WordPress 5.2 - WordPress 6.2
* Compatibility: PHP 7.2 - PHP 8.1 

= [1.2.3] - 2023-01-30 =

**Fixed**

* Fix WP_Error object.

= [1.2.2] - 2023-01-30 =

**Fixed**

* Fix WP_Error object.

= [1.2.1] - 2023-01-09 =

**Fixed**

* Some fixed to improve the operators.

= [1.2.0] - 2022-12-15 =

**Added**

* Sends email periodically. You can choose who is going to receive the emails.
* First approach to WPCLI Commands (thanks to @lbonomo).

= [1.1.0] - 2022-05-18 =

**Fixed**

* Fix: Prevents text domain not given correctly.
* Fix: strings not translated.

= [1.0.1] - 2022-05-17 =

**Fixed**

* Fix: strings not translated.

= [1.0.0] - 2022-05-16 =

**Added**

* Added tabs in Health check.

= [0.2.0] - 2022-05-07 =

**Added**

* Improved the information in plugins list.

= [0.1.0] - 2022-05-06 =

**Added**

* Notification in the plugins list.
* First release.
