WP Manifestindependent plugin directory
manifest / users / xophz-compass-bulletin-board

Xophz Bulletin Board WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Enterprise-grade WordPress forum software, topic dispatcher, and Noosphere Observer engine.

★ 0stars
7release downloads
v26.9.4latest · 1mo ago

Install

Download xophz-compass-bulletin-board-26.9.4.zip From the v26.9.4 release on GitHub, Sep 5, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hallofthegods/xophz-compass-bulletin-board/releases/download/v26.9.4/xophz-compass-bulletin-board-26.9.4.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Xophz Bulletin Board (xophz-compass-bulletin-board)

Category: Trajectory · Version: 26.8.25

An enterprise-grade WordPress forum engine, topic dispatcher, and community board manager natively integrated with YouMeOS, the Noosphere Observer, and standard WordPress theme environments.

Description

Xophz Bulletin Board provides out-of-the-box forum software built directly on WordPress primitives (Custom Post Types, Hierarchical Taxonomies, and Comment Threading). It acts as the single unified data engine powering:

  • The Noosphere Observer & Global Pulse: Synchronized spheres (noo/*) and decentralized community pulse tracking.
  • YouMeOS Sparks: Headless forum windows for Cafeteria ("Food for Thought"), Suggestion Box, and Lunch Room.
  • Standard WordPress Frontends: Native REST API endpoints and shortcodes for non-app visitors.

Core Capabilities

  • Topics & Boards Architecture: Clean WP Admin UI for organizing hierarchical boards, categories, and discussion threads.
  • Term Metadata: First-class support for custom FontAwesome icons (board_icon) and visual sort ordering (board_order).
  • REST Telemetry & Stats: Aggregates reply counts, view counts, and latest activity timestamps across all boards and threads.
  • User Subscriptions: User-level board synchronization persisted via /wp-json/xophz-compass/v1/subscriptions.
  • Pre-Seeded Namespaces: Automated initialization for Noosphere (noo), Suggestion Box (suggestion-box), and Lunch Room (lunch-room).

Requirements

  • WordPress 5.8+, PHP 7.4+
  • Compatible standalone or bundled with Xophz COMPASS

REST API Endpoints

Method Route Description
GET /wp-json/wp/v2/cafeteria_topic Query topic threads (supports pagination, search, board filters, _embed)
POST /wp-json/wp/v2/cafeteria_topic Create a new topic thread
GET /wp-json/wp/v2/cafeteria_board Query boards hierarchy and stats
GET /wp-json/xophz-compass/v1/subscriptions Retrieve user subscribed boards
POST /wp-json/xophz-compass/v1/subscriptions Update user subscribed boards
GET /wp-json/xophz-bulletin-board/v1/pulse Aggregated global activity pulse

License

GPL-2.0+

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v26.9.4 latest
Sep 5, 2026 1mo ago
xophz-compass-bulletin-board-26.9.4.zip
5
Sep 5, 2026 1mo ago
xophz-compass-bulletin-board-26.9.5.zip
2
A- grade

Security

Xophz Bulletin Board 26.9.4-171 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
26.9.4-171
Findings
1
Worst severity
low
Content hash
efa62db99aee5af8a2cb9440…

Findings

  • low Subscription POST allows any logged-in user without capability check

    missing_capability

    update_user_subscriptions permission_callback is only is_user_logged_in(); any role may update their subscription list. Impact limited to own user meta.

    includes/class-xophz-compass-bulletin-board-rest.php:42-48

    Recommendation

    If subscriptions should be members-only, require a specific capability; keep REST nonce requirement.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.