Skip to main content
Start free →

Product

Features How it works The Agent Safety & security About

Resources

Cookbook Blog Docs Changelog Support Alternatives
Pricing Account

Changelog

Everything we ship, in one place: the WPVibe platform at mcp.wpvibe.ai and the WPVibe WordPress plugin. Platform improvements ship continuously; plugin releases are versioned below and install through normal WordPress updates.

1.12.0 — July 23, 2026

  • Fix: safer settings edits. Option values are now treated as plain text unless your AI explicitly asks for JSON (matching the real WP-CLI), and WPVibe refuses any write that would silently change a setting’s stored type, which could previously corrupt cache plugin settings or take a site offline. Reading an option now tells your AI when a value is one string that merely looks like a list.
  • Fix: theme and code edits no longer fail on hosts whose security firewall mistakes legitimate code for an attack. Some hosting firewalls inspect the content of save requests and block anything that looks like PHP or SQL, which made edits to files like functions.php fail intermittently with a 403 error. When that happens, WPVibe now automatically resends the same edit in an encoded form the firewall does not misread, and the plugin decodes it before any of its usual security checks run. Nothing changes about what gets saved or who is allowed to save it.

1.11.0 — July 22, 2026

  • New: White label mode for agencies. One click on the WPVibe admin page (or one ask to your AI) hides WPVibe everywhere in the WordPress dashboard: the admin menu, dashboard widget, Plugins list entry, and editor sidebar. The site stays fully manageable through your AI. WordPress auto-updates keep the plugin current while hidden, and if the site goes 30 days without WPVibe activity the plugin reappears on its own, so it can never be lost.
  • Fix: Content edits now match straight and curly quotes interchangeably. WordPress converts quotes to the curly kind when it saves, which could make an edit fail with “no match” on text your AI had just written.
  • Fix: The WPVibe theme header is now registered on every request, so site_info correctly detects AI-built themes over REST. Props to Nick Kimuli for finding it and opening the fix on our GitHub mirror.

1.10.0 — July 20, 2026

  • New: Beaver Builder support. Your AI can now build and edit real Beaver Builder pages, landing pages, and layouts. The result is a native Beaver Builder layout: open it in the builder and every row, column, and module is there and individually editable, exactly as if you built it by hand. Works with both the free Beaver Builder (Lite) and the paid plugin.
  • New: Beaver Themer support. Build site-wide headers and footers (navigation menus included), plus archive, 404, and single-post layouts, each wired to the right location rules. Themer headers and footers need a Themer-compatible theme (the Beaver Builder Theme, Astra, GeneratePress, Kadence, and similar); WPVibe tells you up front when the active theme cannot render one instead of leaving a layout that shows nowhere.
  • New: “post meta add” appends a row to multi-value post meta, and “post meta delete” accepts an optional value to remove only the matching row. Previously update replaced every row of a key and delete wiped them all, which made multi-value metas effectively untouchable. Divi’s Theme Builder links its templates through exactly this kind of meta, so your AI can now add a second Theme Builder template without destroying the first.

1.9.1 — July 16, 2026

  • Fix: uninstalling a plugin, updating a plugin, or deleting a theme through WPVibe no longer fails with a 500 error. These commands ran WordPress’s own delete and upgrade functions without first loading wp-admin’s filesystem bootstrap, which wp-admin pre-loads but WPVibe’s REST context does not. All file-modifying commands now load it up front.
  • New: update several plugins at once. plugin update now accepts multiple slugs or --all (with --exclude and --dry-run), previews the full list before you confirm, and reports a per-plugin result. WPVibe itself is skipped automatically, since it cannot replace its own files over its own connection.
  • Fix: Google Site Kit (and other plugins that read the logged-in user early) now see the correct user on WPVibe requests. WordPress resolves Application Password logins later than plugins that initialize on init, so Site Kit read an empty Google authorization and rejected every Analytics, Search Console, and PageSpeed request with missing_required_scopes. WPVibe now tells WordPress that REST requests are API requests from the start, so the login resolves before those plugins load.

1.9.0 — July 14, 2026

  • New: WPVibe dashboard widget. Your wp-admin Dashboard now shows whether the site is connected, the last few changes your AI made, and a short list of cookbook recipes matched to the plugins you actually run, each with a copy-ready prompt. Not connected yet? The widget gives you the one-line prompt that connects your site.
  • New: recipe suggestions are filtered on your own site against your installed plugins. The widget fetches one small public recipe list from wpvibe.ai (nothing about your site is sent, same pattern as the WordPress Events and News widget) and picks locally.
  • Improvement: recent AI-made changes are now kept in a small activity log (last 10 entries) so the dashboard can show them; the full record remains in the Approval Log.

1.8.1 — July 13, 2026

  • Fix: SeedProd landing pages now render on your site automatically after WPVibe builds or updates them. The automatic render step added in 1.8.0 only recognized SeedProd theme templates and coming-soon or maintenance pages, so regular landing pages still asked you to open the SeedProd builder and click Save yourself.

1.8.0 — July 10, 2026

  • New: SeedProd pages and theme templates that WPVibe builds now render on your site automatically, without you opening each one in the SeedProd builder and clicking Save yourself. WPVibe triggers the builder’s own save step for you through a single-use sign-in link that expires in two minutes and is scoped to that one page, so nothing else on your site is exposed.
  • Improvement: Elementor pages can now set their WordPress page template at save time (new page_template field on the save-page endpoint): “elementor_canvas” for standalone landing pages, “elementor_header_footer” to keep the theme’s header and footer without the page title. Previously every AI-built page rendered with the theme’s default template, which prints the raw page title above the design on most themes. Unknown template names are saved but flagged in the response warnings.
  • New: Code snippets, safely. Your AI can now draft a code snippet (PHP, JavaScript, CSS, HTML, universal, or text) through the free WPCode plugin. You approve the exact code, type, and placement in your browser before anything is written, and every snippet is saved switched off: you review and enable it yourself in wp-admin, where WPCode runs its own fatal-error check. PHP snippets are also syntax-checked at write time, so a typo is caught before it ever reaches the enable switch. Requires WPCode; without it the feature says so clearly instead of failing cryptically.
  • Hardening: WP-CLI commands can no longer create or edit WPCode snippet posts (including their custom fields and type/location terms). Snippet code always goes through the code approval panel, and enabling a snippet remains something only you can do.
  • New: “post term set”, “post term add”, and “post term remove” assign existing taxonomy terms to a post (by slug, or by id with –by=id), including private taxonomies the REST API cannot reach. Terms are never created implicitly; a missing term is reported with how to create it first.
  • New: “option pluck” reads a single nested key out of a large settings option (plugin settings arrays, JSON blobs) instead of fetching the whole option into the conversation.
  • Improvement: “theme list” now reports update availability (update and update_version fields, plus –update=available), matching what plugin list has done since 1.5.2, so “any theme updates?” is one command instead of probing each theme.
  • Improvement: “cache purge” now detects the official Cloudflare plugin and purges its edge cache alongside the other cache plugins, so a purge actually reaches visitors on Cloudflare-fronted sites.
  • Fix: post create/update accept –post_content_base64 for content that mixes single and double quotes. The plain –post_content flag silently dropped colliding quote characters; the new flag round-trips the content byte for byte, backslashes included.
  • Hardening: “db query” now rejects MySQL executable comments (/*! … */), which could hide a blocked keyword from the query validator.
  • New: “cache purge –url=” purges specific pages instead of the whole cache, on every cache plugin with a URL purge API (LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache, SiteGround Speed Optimizer). Plugins without one still flush fully, and the result says which happened. “–skip=” leaves named layers alone (for example Cloudflare or the object cache).
  • Fix: “cache purge” no longer reports the Cloudflare cache as purged when the Cloudflare plugin’s Automatic Cache Management toggle is off. The plugin silently ignores purge requests in that state; the result now says so and points at the setting.
  • Improvement: cache purges now run origin caches first and Cloudflare last, so the edge cannot re-cache stale pages mid-purge.
  • Improvement: publishing a draft theme now flushes every detected cache as part of the publish itself, so visitors see the new design immediately on every cache plugin, not just the ones that react to a theme switch.
  • Fix: deleting a user by email address now shows the real account details in the approval preview. Previously the preview claimed the user would not be found while the deletion itself would still proceed after approval.
  • Fix: the “transient delete –all” approval preview no longer claims site transients are included; only regular transients are deleted, and the preview now says so.
  • Fix: “widget list” reads sidebars through the WordPress core accessor, so sites upgraded from very old WordPress versions no longer see a bogus “array_version” row.
  • Fix: search-replace always quotes primary-key values in its row queries. On plugin tables with text primary keys, numeric-looking key values could previously match the wrong row and copy one row’s content into another.
  • Fix: “option list –search” and “transient list –search” treat underscores in your search text as literal characters instead of single-character wildcards, so searching blog_* no longer matches unrelated options.
  • Improvement: truncated previews of long post, comment, and option values now cut cleanly on multibyte (emoji, accented, CJK) content.

1.7.1 — July 9, 2026

  • Fix: CLI commands that carry punctuation inside a quoted value (a serialized setting, an SEO title with a pipe) are no longer rejected as unsafe. Quoted values are treated as data; the safety checks on command structure are unchanged.
  • Fix: Publishing a draft theme now works on hosts that block deleting the live theme folder, by swapping the folders instead of deleting and recopying. If anything goes wrong mid-publish, a complete backup is kept and the message says exactly where.
  • Improvement: When a draft theme action finds no draft, the message now says whether the last draft was published or deleted and when, so your AI stops trying to recreate a draft you already finished with.
  • Improvement: Every error the plugin reports now includes structured facts about what went wrong (the cause, whether retrying can help, and whether the connected account is an administrator), so AI assistants stop guessing at remedies and stop repeating fixes that cannot work.
  • Fix: Permission denials when creating content or editing custom fields through the CLI tools now surface as a proper permission error naming the post type and capability, instead of a quiet command failure that error tracking never recorded.

1.6.3 — July 8, 2026

  • Fix: Administrators were blocked from editing content that belongs to plugins with their own permission schemes (WPForms forms, some LMS and e-commerce post types). Content search and edit now work for administrator accounts on those post types. Post types that explicitly forbid editing (such as order records) stay locked, and protected fields keep their existing safeguards.
  • Fix: The error shown when an account lacks permission for a specific post now names the post and its type, and no longer suggests reconnecting when reconnecting would not help.
  • Improvement: Site info now reports which WordPress account is connected and its role, so your AI assistant can spot a limited account up front instead of failing mid-task.

1.6.2 — July 8, 2026

  • Improvement: The plugin now displays as WPVibe, matching the product brand at wpvibe.ai. Same plugin, nothing else changes.
  • Fix: “plugin update vibe-ai” no longer tries to replace the plugin’s own files over its own connection, which failed with an unhelpful server error. It now explains that WPVibe should be updated from the wp-admin Plugins screen or via auto-updates.

1.6.1 — July 7, 2026

  • Fix: “option list –autoload=on|off” returned no rows on WordPress 6.6+ (the query only matched the legacy yes/no autoload values). It now matches the current on/off/auto-on/auto-off/auto values as well.
  • Fix: “option update” and “option patch” no longer report a false failure when writing a numeric or boolean value (JSON decoding produced an int/bool while WordPress stores scalars as strings; setting an option to its current value also tripped this).
  • Fix: “user list” now includes user_registered, so account age is available to site-audit workflows.
  • Fix: WP-CLI commands no longer have HTML tags silently stripped from their values (a value like “<b>x</b>” was stored as “x”, and script blocks vanished entirely, surfacing as a confusing usage error). Commands containing angle brackets are now rejected with a clear message pointing to the content editing tools, which handle HTML safely.
  • Fix: “post list” was silently ignoring targeting flags (–s, –year, –monthnum, –author) and returning the full unfiltered list, which is dangerous when a listing feeds a bulk operation. Those filters now work, and unsupported flags are rejected with a clear message instead of ignored.
  • Fix: “post create” now honors –post_date (site-local time, matching WP-CLI) instead of silently creating the post dated today.
  • Fix: “post list” now accepts a comma-separated –post_type (e.g. post,page) instead of returning an empty list.
  • Fix: draft themes can now be deleted on hosts that block the HTTP DELETE method at the server (a POST alias was added; previously the cancel action failed with a 405 on many hardened hosts).
  • Improvement: “option get” now allows reading users_can_register and default_role (writes remain blocked). Security-audit workflows need to check whether open registration is enabled.

1.6.0 — July 2, 2026

  • New: WP-CLI checksum verification. “core verify-checksums” and “plugin verify-checksums” (single plugin or –all) compare installed files against the official WordPress.org checksums and report modified or missing files, so an assistant can run a file-integrity check when investigating a possibly compromised site.
  • Improvement: core verify-checksums also reports unknown files inside the core directories (the “File should not exist” check from real WP-CLI, the half that catches injected malware) and supports –include-root, –exclude, –version, and –locale. plugin verify-checksums skips readme.txt/readme.md by default (WordPress.org regenerates readmes after release) with –strict to include them, and reports files added to a plugin folder that are not part of the official release.
  • New: Read-only WP-CLI commands assistants ask for most: core version, core check-update, db tables, db prefix, post-type list, menu location list, theme mod list, and plugin get.
  • Feature: Unified cache purge. “cache purge” detects the installed cache plugin (LiteSpeed Cache, WP Rocket, SG Optimizer, WP Super Cache, W3 Total Cache, Breeze, plus the Elementor CSS cache) and calls each plugin’s own purge API, then flushes the object cache. The plugin-specific spellings assistants guess first (litespeed-purge, elementor flush-css, rocket clean, sg purge, super-cache flush, w3-total-cache flush, breeze purge) work as scoped aliases.
  • New: “config get <constant>” reads a single configuration constant (and table_prefix) for diagnostics like WP_DEBUG or DISALLOW_FILE_EDIT. Credentials and secrets (database credentials and anything matching KEY, SALT, SECRET, PASSWORD, or TOKEN) are blocked outright, and config list/set/edit remain blocked.
  • New: “option patch insert|update|delete” makes surgical changes to one key inside a nested settings array (plugin settings like Rank Math) without rewriting the whole option.
  • Hardening: Deleting an option now pauses for browser approval with a preview of the stored value, since options have no trash and a plugin’s entire configuration can live in one. The AI’s own temporary options (wpvibe_task_ prefix) and transients stay approval-free, and the session-bypass checkbox covers repeated cleanup.
  • Feature: Role and capability editing, the gap core REST cannot fill (the reason role-editor plugins exist): cap add/remove on roles, role create (with –clone), role delete, role reset (restore WordPress defaults), and user add-cap/remove-cap. Every change pauses for browser approval with the literal grant spelled out, administrator-equivalent capabilities are flagged in the preview, and lockout protections refuse removing core capabilities from the administrator role, deleting the administrator role, or deleting the last administrator user. role reset is the escape hatch back to WordPress defaults.
  • New: “cron event run <hook>” and “cron event delete <hook>” (both approval-gated) complete the stuck-cron debugging loop alongside cron event list and cron test.
  • New: “theme install”, “theme update”, and “theme delete” (delete approval-gated; refuses the active theme and the parent of an active child theme), symmetric with the existing plugin management commands.
  • Feature: search-replace is now implemented (previously a stub). It performs serialized-data-aware replacements (nested arrays and objects are unserialized, replaced, and re-serialized with correct lengths, so widget settings and theme mods survive a domain migration), works table by table in primary-key chunks, skips the guid column by default (–include-guids to opt in), supports –dry-run, –skip-tables, –skip-columns, and explicit table arguments, and reports completed vs remaining tables if it hits the time budget. Live runs pause for browser approval with per-table match counts, and the preview warns loudly when the replacement would change the site URL; –dry-run runs without approval.
  • New: Permission diagnostics. “cap list <role>” (with –show-grant) and “role list” let an assistant show exactly which capability a role is missing instead of hand-waving at a permission error.
  • New: “maintenance-mode status” reports the effective maintenance state from all three sources: the core .maintenance file (honoring the 10-minute expiry), the wp-content/maintenance.php drop-in, and known maintenance/coming-soon plugins (SeedProd, LightStart, Under Construction, CMP, Maintenance) with their enable state.
  • New: “cron test” verifies WP-Cron spawning end to end (DISABLE_WP_CRON, ALTERNATE_WP_CRON, and a live loopback spawn check), so stuck-cron debugging has a first step.
  • New: Symmetric read commands: media image-size, transient get (with –network), menu item list, user get, and theme get.
  • New: Command discovery. “help” returns the full supported-command catalog (name, tier, usage, approval requirements) generated from the security allowlist, and “help <command>” filters it, so an assistant discovers what is supported instead of burning calls guessing. “cli version” and “cli info” return honest emulator identity (plugin version, WordPress and PHP versions) instead of an error, so an assistant probing the environment gets accurate expectations rather than concluding WP-CLI is broken.

1.5.2 — July 1, 2026

  • Fix: The WP-CLI plugin list command now reports update availability. It exposes “update” (available/none) and “update_version” fields and honors the –update=available filter, so an assistant can reliably see which plugins have updates instead of getting blank update info.
  • Fix: Permission-denied errors now name the specific missing WordPress capability (e.g. “edit_theme_options”) instead of WordPress’s generic “not allowed” message, so an assistant connected with a lower-privilege account gets an actionable next step instead of a dead end.

1.5.1 — June 30, 2026

  • Hardening: Image imports now pin the download to the exact IP address that passed the security check, closing a DNS-rebinding window where a hostname could switch to an internal address between validation and download.
  • Hardening: Content meta edits and searches now enforce WordPress per-key meta permissions, so a user can no longer read or change protected post meta they are not authorized for, even on posts they can otherwise edit.
  • Hardening: The WP-CLI post meta update and delete commands now guard every protected meta key (not just core internal keys) behind the same explicit –force override.
  • Fix: Image imports no longer fail with “you are not allowed to upload this file type” when the source name has dots before the extension (e.g. macOS screenshots like “…14.45.58@2x”). The importer now derives the extension from the file’s actual type instead of trusting the parsed name.

1.5.0 — June 25, 2026

  • Feature: Surgical content edits. WPVibe can now make targeted find-and-replace changes to a post’s content, excerpt, or title, to post meta, and to site options without rewriting the whole value. Two new endpoints (content search and content edit) locate the exact text first and then replace a single match (or all matches), so large posts no longer have to round-trip through the AI in full. Serialized values are refused so they cannot be corrupted.
  • Feature: Bulk cleanup commands. The post update, post delete, user delete, and plugin uninstall commands now accept several targets in one call, so the AI can tidy up a batch of posts, users, or plugins in a single step.
  • Feature: Approval previews now list every affected item. When an irreversible action touches more than one target (permanently deleting posts, deleting users, uninstalling plugins), the confirmation screen enumerates each one so you can review the full list before approving. Reversible actions (moving posts to trash, updating posts) continue to run without interruption.
  • Hardening: Clearer database change previews. Update queries now show a sample of the rows that will change (previously only deletes did), and long values are trimmed in the preview so a wide table stays readable.
  • Hardening: The approval gate for direct SQL now also covers REPLACE, CREATE, RENAME, and GRANT/REVOKE statements, so those route through the same human confirmation as other database writes.
  • Fix: Frontend edit affordances now render only for registered WPVibe fields/settings, preventing accidental edit markers on unrelated template attributes.
  • Fix: Classic starter theme front-page hero fields now resolve against the configured static front page, so the hover-to-edit links point to the correct page fields.
  • Maintenance: Classic starter theme declares responsive-embeds support so embedded media scales correctly on mobile.

1.4.0 — June 1, 2026

  • Feature: Field API for theme authors — register editable custom fields and global settings from a theme’s functions.php via wpvibe_field_register(), wpvibe_setting_register(), and wpvibe_field_group_register(). The plugin handles admin meta box rendering, save handlers, and sanitization across 12 field types (text, textarea, number, email, url, date, checkbox, color, image, gallery, wysiwyg, post_select, repeater). Templates read native get_option() / get_post_meta() so they keep rendering when the plugin is deactivated.
  • Feature: “WPVibe AI” meta box on every post edit screen for themes that declare WPVibe: yes in their style.css header — surfaces registered fields for the current post type plus a “Connect Claude / ChatGPT” CTA when no MCP client is paired to the site.
  • Feature: Frontend hover-to-edit affordance — registered fields render with a dashed outline + edit pin during draft preview, click to jump to the wp-admin edit screen for that field.
  • Feature: Hybrid classic starter theme — Tailwind v4 (browser CDN at draft time, compiled dist/styles.css at publish) + Gutenberg color/typography integration driven by the same theme.css @theme tokens. Bundles Alpine.js v3.15.12 for interactivity (modals, dropdowns, tabs, accordions, sliders). No theme.json — single source of truth.
  • Feature: Cookie-based draft preview that survives wp-admin navigation. Admins with edit_themes see the draft theme across the whole admin so the field API works in wp-admin without needing the preview-token query string on every URL.
  • Feature: Elementor integration with four new REST endpoints — GET /wpvibe/v1/elementor/widgets (list installed widgets + structural elements), GET /wpvibe/v1/elementor/schema?slug= (control schema discovery for a widget or element), POST /wpvibe/v1/elementor/save-page (atomic create or update of an Elementor page), POST /wpvibe/v1/elementor/save-template (Elementor Pro theme builder templates with display conditions). All routes return 404 with elementor_inactive when Elementor isn’t installed.
  • Feature: Per-request REST timing — every WPVibe REST response now carries an X-WPVibe-PHP-Time-Ms header so MCP clients can break down “why is this slow?” by Worker overhead, network round-trip, and time spent in WordPress PHP.
  • Feature: Human-in-the-loop approval for destructive operations. AI-initiated db query mutations (DELETE/UPDATE/DROP/etc.), user deletes, plugin uninstalls, and --force trash bypasses now pause and surface an approval URL the user must open and confirm in their browser before WPVibe executes them.
  • Feature: New WP-CLI-style commands so the AI can clean up after itself — option add, option delete, transient delete (with --all / --expired modes), and transient list. Non-blocked option/transient deletes auto-execute; protected core options (siteurl, active_plugins, auth_*, etc.) remain hard-blocked.
  • Feature: Approval Log admin tab (WP admin → WPVibe → Approval Log) — append-only audit of every destructive operation WPVibe has executed on this site, including the dry-run preview the user saw before approving and the post-execution result summary.
  • Feature: New /wpvibe/v1/cli/run-approved, /wpvibe/v1/audit-log, and /wpvibe/v1/registered-meta REST endpoints.
  • Hardening: Destructive operations classified by command/SQL keyword rather than a default-deny allowlist. The narrow list (mutating SQL, user delete, plugin uninstall, post delete --force) returns approval_required with a row-count preview when the operation hits the database; all other commands continue to auto-execute behind the existing per-command capability checks.
  • Fix: Custom post types now auto-receive the 'custom-fields' post type support when fields are registered via wpvibe_field_register() — was silently dropping meta on REST writes for CPTs that lacked it.
  • Fix: First write to a new subdirectory of the draft theme (e.g. dist/styles.css) no longer fails with “Resolved path is outside the draft theme” — path-safety check walks up to the nearest existing ancestor for the realpath validation.
  • Fix: publish_draft_theme now tolerates a missing live theme directory (interrupted prior publish, manual delete) and creates the live from the draft instead of fatal-ing inside RecursiveDirectoryIterator.

1.3.0

  • Feature: New unauthenticated /wpvibe/v1/ping endpoint returns plugin and WordPress version so the WPVibe MCP server can detect plugin presence before generating an OAuth magic link. Cuts the “magic link works but plugin is missing” failure mode that strands users mid-onboarding.

1.2.3 — May 15, 2026

  • Fix: Draft theme name no longer accumulates “(WPVibe Draft)” on every publish cycle — the suffix is now stripped on both create and publish, and the theme header cache is invalidated after restore. Thanks to J. Hoon Yu for the report.

1.2.2 — May 11, 2026

  • Security: SSRF hardening on /upload-media — validate every resolved A and AAAA record against private, loopback, link-local, and reserved ranges; re-validate redirect hops
  • Security: Server-side user scoping on /last-change so a lower-privilege user can’t read change summaries from an admin session
  • Security: Require edit_theme_options or edit_posts in addition to the x_wpvibe header before bumping the admin “Connected” indicator
  • Security: 24-hour TTL on the draft theme preview token so a leaked URL can’t be used indefinitely
  • Security: Remove SVG from the file-write allowlist (SVG can embed script and isn’t needed for classic-theme scaffolding)
  • Fix: Resolve an undefined variable when building the “View Trash” admin URL in the change tracker
  • Maintenance: Uninstall now clears wpvibe_last_active, wpvibe_preview_token_issued, the activation-redirect transient, and any leftover *-wpvibe-draft / *-wpvibe-backup theme directories on disk
  • Thanks to Rob Weaver for the responsible disclosure

1.2.1 — April 20, 2026

  • Compliance: Migrate inline styles and scripts to wp_enqueue_style / wp_enqueue_script
  • Compliance: Replace direct PHP file I/O with the WP_Filesystem API across theme and file operations
  • Compliance: Replace exec()-based PHP syntax validation with in-process tokenizer
  • Feature: Unsplash stock photo search with third-party service disclosure
  • Fix: Allow SQL comparison operators in db query and honor the –limit flag; add {prefix} placeholder
  • Fix: Detect an active WPVibe connection via last-active timestamp instead of the auth token
  • Fix: Custom CLI command sanitizer that preserves angle brackets used by SQL queries

1.1.0

  • Expanded WP-CLI dispatcher with 16 new commands (34 total)
  • Security: Block sensitive options (auth keys, salts) from being read via option get
  • Security: Whitelist post get return fields (excludes post_password)
  • New read commands: plugin search, option list, taxonomy list, term list, post meta get, media list, comment list, comment count, sidebar list
  • New write commands: post create, post update, post delete, post meta update, post meta delete
  • Plugin install and update with two-phase confirmation flow
  • Content truncation for large post_content and post_content_filtered fields
  • Flag normalization: hyphenated flags (–per-page) auto-convert to underscored (–per_page)

1.0.0

  • Initial release
  • WordPress site connection with one-click authorization
  • Full WordPress REST API access for AI content management
  • WordPress Abilities API support (WP 6.9+)
  • WordPress theme file browsing (list, search, outline)
  • WordPress theme editing via draft-preview-publish workflow
  • Classic WordPress theme builder
  • WordPress WP-CLI native dispatch
  • WordPress media uploads from URL
  • Unsplash stock photo search
  • Smart live reload with context-aware navigation
  • Progressive skills system for guided AI WordPress workflows