WP Manifestindependent plugin directory
manifest / content / xophz-compass-quests

Xophz Questbook CRM WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Questbook: All-in-one customer relationship manager (CRM), client interaction tracker, and activity audit log.

★ 0stars
23release downloads
v26.9.4latest · 1mo ago

Install

Download xophz-compass-quests-26.9.4.zip From the v26.9.4 release on GitHub, Sep 5, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hallofthegods/xophz-compass-quests/releases/download/v26.9.4/xophz-compass-quests-26.9.4.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Category: Trajectory · Version: 1.0.0

A CRM that manages client profiles, tasks, assets, and integrations without ever leaving WordPress.

Description

Questbook is a comprehensive Customer Relationship Management (CRM) system for the COMPASS platform. It replaces expensive third-party tools by centralizing client data, project assets, and WPMU DEV Hub integration directly into your WordPress dashboard, all presented via a futuristic, glassmorphic UI.

Core Capabilities

  • Contact Management – Custom Post Type (compass_contact) to store comprehensive client profiles including names, emails, roles, companies, and associated assets.
  • Client Assets – Upload, tag, and manage client-specific files (logos, brand assets, documents) directly tied to their profile.
  • WPMU DEV Hub Integration – Syncs directly with WPMU DEV's Hub API to manage sites, services, client billing, and reports right from within Questbook.
  • REST API – Fully featured REST API for seamless integration with the Vue frontend.

Requirements

  • Xophz COMPASS parent plugin (active)
  • WordPress 5.8+, PHP 7.4+

Installation

  1. Ensure Xophz COMPASS is installed and active.
  2. Upload xophz-compass-quests to /wp-content/plugins/.
  3. Activate through the Plugins menu.
  4. Access via the My Compass dashboard → Questbook.

PHP Class Map

Class File Purpose
Xophz_Compass_Quests class-xophz-compass-quests.php Core plugin hooks and loader
Xophz_Compass_Quests_CPT class-xophz-compass-quests-cpt.php Defines the compass_contact post type
Xophz_Compass_Quests_Rest class-xophz-compass-quests-rest.php Handles CRUD REST API for contacts
Xophz_Compass_Quests_API class-xophz-compass-quests-api.php Additional REST routes
Xophz_Compass_Quests_WPMUDEV class-xophz-compass-quests-wpmudev.php Integration with WPMU DEV Hub

Frontend Routes

Route View Description
/quests Questbook Dashboard Contact list, stats, and search interface
/quests/:id Contact Detail Deep dive into client profile, assets, and Hub linkage

Changelog

1.0.0

  • Initial release with compass_contact CPT, Contact REST API, Client Assets manager, and WPMU DEV Hub integration.

Releases

21 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v26.9.4 latest
Sep 5, 2026 1mo ago
xophz-compass-quests-26.9.4.zip
5
Sep 5, 2026 1mo ago
xophz-compass-quests-26.9.5.zip
2
Aug 31, 2026 1mo ago
xophz-compass-quests-26.8.30.zip
1
Aug 31, 2026 1mo ago
xophz-compass-quests-26.8.31.zip
1
Aug 28, 2026 1mo ago
xophz-compass-quests-26.8.27.zip
1
Aug 28, 2026 1mo ago
xophz-compass-quests-26.8.28.zip
1
Aug 10, 2026 2mo ago
xophz-compass-quests-26.8.9.zip
1
Aug 10, 2026 2mo ago
xophz-compass-quests-26.8.10.zip
1
Aug 7, 2026 2mo ago
xophz-compass-quests-26.8.6.zip
1
Aug 7, 2026 2mo ago
xophz-compass-quests-26.8.7.zip
1
Jul 24, 2026 3mo ago
xophz-compass-quests-26.7.23.zip
0
Jul 24, 2026 3mo ago
xophz-compass-quests-26.7.24.zip
0
May 29, 2026 4mo ago
xophz-compass-quests-26.5.29.zip
2
May 28, 2026 4mo ago
xophz-compass-quests-26.5.27.zip
0
May 28, 2026 4mo ago
xophz-compass-quests-26.5.28.zip
0
May 25, 2026 5mo ago
xophz-compass-quests-26.5.24.zip
1
May 25, 2026 5mo ago
xophz-compass-quests-26.5.25.zip
0
May 3, 2026 5mo ago
xophz-compass-quests-26.5.2.zip
4
May 3, 2026 5mo ago
xophz-compass-quests-26.5.3.zip
0
Apr 28, 2026 5mo ago
xophz-compass-quests-26.4.28.zip
1
Apr 27, 2026 5mo ago
xophz-compass-quests-26.4.27.zip
0
C- grade

Security

Xophz Questbook CRM 26.9.4-181 · audited by WP Registry

High-severity findings.

1 high
Audited release
26.9.4-181
Findings
1
Worst severity
high
Content hash
aa01cbcb753d53bcd5233e26…

Findings

  • high Twilio/email webhooks accept unauthenticated forged messages with no signature check

    missing_auth

    Routes /webhooks/twilio and /webhooks/email use permission_callback __return_true and insert contacts/logs from request body without verifying Twilio request signatures or shared secrets. Attackers can spam the CRM inbox and create fake leads.

    includes/class-xophz-compass-quests-rest.php:150-164,1201-1291

    Recommendation

    Validate Twilio X-Twilio-Signature (and an HMAC/shared secret for email webhooks) before inserting data.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.