On scanning I am getting this vulnerability report –
‘The XML-RPC interface is enabled. This significantly increases your site’s attackers. “
I have tried all the possible ways,but unable to resolve the issue
please suggest a way to resolve it
]]>Deleted because they are no more interesseted on non-enterprise customers ;-(
]]>Please note: This plugin is no longer actively supported for non-enterprise customers. Enterprise users should contact WPScan directly via email for support.
For all other users, we recommend using Jetpack Protect – a free security plugin for WordPress that leverages the extensive database of WPScan. Jetpack Protect scans your site and warns you about vulnerabilities, keeping your site one step ahead of security threats.
]]>Hi, I am currently working with the WPScan plugin, as we know WPScan plugin can get results as PDF after the scan and we can download it, but is it possible that the WPScan plugin can send results as JSON with webhook/API after the scan to the third party like Jira /defectdojo/etc?
]]>Great plugin! But:
Compatible With WordPress Version: 5.8.6
Please test and support for never WordPress like soon version 6.1
Thanks
Btw:
In your description on https://www.ads-software.com/plugins/wpscan/ it says:
Video unavailable, This video is no longer available because the uploader has closed their YouTube account.
Hi,
After installing the plugin, I clicked the Report > Run All button 48 hours ago. Still it’s loading. https://prnt.sc/hDpB-5VQptv4
Is that normal? or what’s the issue? My website is a blog site and it’s not big.
]]>This plugin was updated last month, but its showing compatibility for version, 5.8.4.
Can it be updated and confirmed compatibility with WordPress 6.0.1 please?
]]>Hi,
I am getting e-mail alerts of plugins which contain vulnerabilities of 1 or 2 plugins which are not in my WP install (also not anymore as inactive plugins), not in the WPScan plugin “Settings” nor in the “Report” in the WP dashboard.
The only reference is in the alert e-mail. Any idea what’s going on? Are the e-mail alerts subject to any caching?
P.s. I hope this plugin stays alive and keeps rocking, I will never install Jetpack!
]]>Hello,
Would it be possible to remove the use of file_get_contents to prevent PHP warnings when allow_url_fopen is disabled on the server for tightened security.
The request is made in the wpscan/views/report.php file on line 11 to the logo.svg file. I see the svg file is requested in settings.php but is requested directly there.
Perhaps that could be updated to match the settings.php request:
<?php echo ‘<h1> ) . 'assets/svg/logo.svg){kind=logo}
</h1>’; ?>
Instead of:
<?php echo file_get_contents( plugin_dir_url( dirname( __FILE__ ) ) . ‘assets/svg/logo.svg’); ?>
Hi,
I have continuous warnings about https problem. But I have https redirect in my .htaccess and it works. How can I disable only this https alert because it is false positive and noisy (I need to keep email notifications)…
Security check Website HTTPS
The website does not seem to be using HTTPS (SSL/TLS) encryption for communications.
Found our WPScan security plugin helpful? Please leave a review.
Thank you,
The WPScan TeamI am using a plugin and WPScan detected a vulnerability. The notification has a misspelling in it. This is more aesthetics than a functional issue.
>>>>>>>>>>
Unauthorised AJAX Calls via Freemius
We are not aware of a fix for this vulnerability.
<<<<<<<<<<
Unauthorised should be Unauthorized.
]]>Hi,
Tried activating wpscan plugin but receive below error
Table wordpres_actionscheduler_actions’ doesn’t exist.
We use wordpress version 5.9
Regards,
Tushar
Hi,
How can i disable the automatic scanning please?
I would like to run scans only on demand.
Thank you in advance!
]]>Hi,
It is possible to launch a scan with the code from another plugin ?
Thanks
]]>In https://www.ads-software.com/support/topic/option-to-disable-security-checks/ an option was added to enable/disable all checks.
But I only wanted to disable the bruteforce testing because this is a very particular class of test regarding my system-configuration and limitations.
A simple filter hook to filter checks (or a wp_options accepting a list of check’s names) would be far better than what’s been provided in 1.15.2
]]>Hello guys,
scan on my site says the following:
“The website does not seem to be using HTTPS (SSL/TLS) encryption for communications.”
But SSL checker says everything is alright.
All pages have https://
Redirection works properly.
Do you have any idea where can be the problem?
I saw you dealt with it a year ago: https://www.ads-software.com/support/topic/https-ssl-warning-message/
Thanks a lot.
Best regards,
Jan
]]>Hi, as per suggestion in your blog, I try to disable the XML-RPC. It fails with an error:
Uncaught Error: Cannot use object of type WP_Error as array in [..]/wp-content/plugins/wpscan/security-checks/xmlrpc-enabled/check.php:85
Any ideas?
Thanks for your help!
regards, Jeroen
]]>Hi,
Congrats on the new merge with Automattic.
What will happen to the future of this plugin? Will it eventually be deprecated and moved into jetpack?
Thanks!
]]>Hello,
I am not using your plugin but I have used Wpscan with the command line in Ubuntu.
I run this line: wpscan --url mydomainhere
And it breaks my website. Now my site is down and I don't know what to do ...
Can you help me ?Is it possible to disable Automated Scanning?
I just want manual scanning.
Received a report from WPscan this morning stating it appears one of my sites is not using https and is not secure. When I load the homepage in the current version of Firefox, the lock/icon has an exclamation mark and when clicked, it states, “Connection not secure. Parts of this page are not secure, (such as images).” Then when I rerun the the https test, it states, “Your website seems to be using HTTPS.”
Why would that be?? When I refreshed the page, the lock/icon showed as secure; Firefox apparently now sees it as secure; but what would have triggered the unsecured flag in FF that appears to also have been picked up by wpscan? And more importantly, how can images (or other files) not be covered by the certificate?? All the images on the site are within the public_html on the hosting server, none are pulled from outside; at least as long as no one has tampered with them.
Anyone able to provide some insights please?
Thanks in advance.
https://www.loom.com/share/f043252d515d4542a7bc09fa15054af0
Hello SIR, Its a 14 seconds video which explained my sites issues.
When i open my sites , it is being redirected to another link.
Hosting guys says its due to ‘corrupt .htaccess file and SQL injections etc.’
Hosting is namecheap.
This has been happening with all of my websites again and again in last month. I have 15 sites and this issue has happened with my sites many times.
I ran scanner many times, read reports and cleared my cpanel many times, one by one.. But still i don’t know how the hell this issue is happening ?
Every time I have to come to hosting support and they do something like disbale htacess file or restore default file and they fix one site,. And meanwhile fixing this , another site breaks down.
SO My question is
Can your plugin stop this ?
Stop these issues or stop breaking my sites again and again ???
Please reply me with your expertise and advice
Thank you!!!
]]>I am on Version 1.15.3 and I noticed the automated scanning feature schedules the scans inconsistently.
I have the following settings set:
Automated Scanning – Daily
Scanning Time – 6PM UTC
And these are the wpscan job timestamps from Scheduled Actions:
1st Run – 2021-06-25 18:00:00 +0000 (Time is correct)
2nd Day – 2021-06-26 19:33:44 +0000
3rd Day – 2021-06-27 20:23:15 +0000
4th Day – 2021-06-28 20:34:48 +0000
With each day the wpscan_schedule scanning time is pushed further back. I expected every day to run at the specified scanning time, but it is not.
]]>Hi,
I am using 1.15.2 and set my premium API token with define( 'WPSCAN_API_TOKEN') in my wp-config.php. WP Scan functions great, does scanning twice a day. All good!
However, it keeps nagging that I have entered an invalid API Token at the “Report” page:
Is this a bug?
Looking forward to your reply. Thanks!
]]>Hello,
I’m running version 1.15.2 of the plugin and keep getting the following error:
[14-Jun-2021 11:05:32 Europe/London] PHP Fatal error: Uncaught Error: Call to undefined method WPScan\Checks\System::get_check_vulnerabilities() in /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins/wpscan/app/Summary.php:188
Stack trace:
#0 /opt/bitnami/apps/wordpress/htdocs/wp-includes/class-wp-hook.php(286): WPScan\Summary->ajax_security_check_now('')
#1 /opt/bitnami/apps/wordpress/htdocs/wp-includes/class-wp-hook.php(310): WP_Hook->apply_filters('', Array)
#2 /opt/bitnami/apps/wordpress/htdocs/wp-includes/plugin.php(453): WP_Hook->do_action(Array)
#3 /opt/bitnami/apps/wordpress/htdocs/wp-admin/admin-ajax.php(99): do_action('wp_ajax_wpscan_...')
#4 {main}
thrown in /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins/wpscan/app/Summary.php on line 188I checked and get_check_vulnerabilities() does not exist in the referenced class. Swapping it to security_check_now() seems to resolve the issue.
]]>On WP installation with huge amount of files (pictures mostly) WPScan cannot complete scan because it reaches memory_limit or max_execution_time, whatever comes first. Example error generated in log when this happens:
[31-Mar-2021 06:41:10 UTC] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 134217736 bytes) in /var/www/wordpress/wp-admin/includes/file.php on line 164
Tested with WordPress 5.7 and PHP 7.4.15.
]]>app/plugin.php $WPSCAN_ROLE should have a filter.
There could be users with capability manage_options that shouldn’t still see this page. I can hide it from the menu but that isn’t optimal solution for this.
Hi,
Is it possible to include an option to disable all or individual “Security Checks”? Just like you guys did for “Ignore items” (plugins/themes) in the plugin settings?
I don’t have any need for these additional security checks as I use dedicated code for these checks, it’s just unrequired overhead as I use WPScan primary for scanning my theme+plugins only.
Looking forward to your reply. Thanks and keep rockin’.
Hi
I got a report
“The website does not seem to be using HTTPS (SSL/TLS) encryption for communications”
When I ran it manually, it went away.
The url uses https
Why would this occur?
What does it check?
After update to the new version 1.14 and try to run the new “Weak Passwords” security check, running it as a seperate check from the Action session, the test seems to never end as many times as we run it. After refreshing the tab in order to try to re-run it it seems that never happend with the message next to it “Not checked yet. Click the Run button to run a scan”. Trying again to re-run it and it seems its in a loop and the test never ends.
]]>