WP Manifestindependent plugin directory
manifest / content / daily-quran-verse

Daily Quran Verse WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Daily Quran Verse - Inspire Your Day with Divine Wisdom The Daily Quran Verse plugin brings the timeless wisdom of the Quran right to your WordPress website. Easily display a new Quranic verse every day to enlighten and inspire your visitors, creating a space for reflection and spiritual growth.

by Moursalin Islam · github.com/moursalinislambd/daily-quran-verse · website

★ 2stars
18release downloads
≈10active sites
V.1.0.2latest · 1 year ago

Install

Download daily-quran-verse-v-1-0-2.zip From the V.1.0.2 release on GitHub, Jan 27, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/moursalinislambd/daily-quran-verse/releases/download/V.1.0.2/daily-quran-verse-v-1-0-2.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.
Readme github.com/moursalinislambd/daily-quran-verse ↗

Daily Quran Verse - Inspire Your Day with Divine Wisdom

The Daily Quran Verse plugin brings the timeless wisdom of the Quran right to your WordPress website. Easily display a new Quranic verse every day to enlighten and inspire your visitors, creating a space for reflection and spiritual growth. It is compatible with WP-Bakery, Elementor, Gutenberg, and the Classic Editor, and also provides a shortcode for easy integration.

Fully Checked in
  • Virustotal Checked: VIRUSTOTAL
  • MetaDefender : MetaDefender
  • jottie.org : jottie.org
  • Kaspersky Threat Intelligent Portal : Kaspersky

    • Features:

    • Automatic Daily Verse: A new verse is automatically displayed each day, offering consistent inspiration and guidance.

    • Admin Dashboard Widget: Display daily Quran verse in admin dashboard widget.

    • Elementor Integration: Seamlessly integrate Quranic verses with Elementor using a dedicated widget, complete with customizable styles and layouts.

    • WP-BAKERY Integration: Seamlessly integrate Quranic verses with WP-BAKERY using a dedicated widget, complete with customizable styles and layouts.

    • Classic & Gutenberg Support: Compatible with the default WordPress editor, Gutenberg blocks, and Elementor. No matter what editor you prefer, Daily Quran Verse is ready to work with it.

    • Customizable Shortcode: Use the simple [daily_quran_verse] shortcode to place verses anywhere on your site—posts, pages, widgets, and more!

    • Widget Flexibility: Add Quranic verses to your sidebar, footer, or any widget area, creating a spiritually uplifting space anywhere on your website.

    • Custom Design Options: The verses are displayed beautifully with elegant blockquotes and reference tags, making the content visually appealing.

    • Social Share: You can share the verse in one-click.

    • Feedback Form: If you face any issue or give me any suggestion.

    • Copy Verse: You can copy the verse and anywhere want to pest it.

    • Easy Setup: Simple to install and use—just upload your Quranic verses in a JSON file and let the plugin handle the rest.

    Why Choose Daily Quran Verse?

    Bring a sense of peace, motivation, and daily reflection to your visitors. Whether you are running a personal blog, a community website, or an educational platform, this plugin provides an effortless way to connect with your audience through the powerful words of the Quran.

    Perfect for:

    • Islamic blogs and websites
    • Educational platforms
    • Community centers and mosques
    • Personal or family websites
    • Any website looking to provide daily spiritual insight

    Documentation

    This plugin is fully compatible with

    • Gutenberg editor (Drag & drop page builder).
    • Elementor (Drag & drop page builder).
    • WP-BAKERY (Drag & drop page builder).
    • Classic editor. Use this Shortcode [daily_quran_verse]
    • Shortcode. Use the simple [daily_quran_verse] shortcode to place verses anywhere on your site—posts, pages, widgets, and more!
    • Widgets for easy placement

    Screen-Shot


    WP-BAKERY
    Screenshot-2025-01-27-185725 Screenshot-2025-01-27-185800 Screenshot-2025-01-27-185832
    ELEMENTOR
    Screenshot-2025-01-27-190415
    WORDPRESS WIDGET
    Screenshot-2025-01-27-190402
    WORDPRESS SHORTCODE
    Screenshot-2025-01-27-190349
    FEEDBACK FORM
    Screenshot-2025-01-27-190046
    DASHBOARD WIDGET (ADMIN)
    Screenshot-2025-01-27-185954

    Changelog

    [VERSION] 1.0.1
  • WP-BAKERY compatible.
  • Added more Quran verse.
  • Added social sharing system.
  • Added copy verse.
  • Fix elementor widget issue.
  • Fix update issue.
  • Minor bug fix.

    • [VERSION] 1.0.0
  • Initial release of the Daily Quran Verse plugin.

    • Support

    If you have any questions or need support, please visit our support page or contact us at dev.onexusdev@gmail.com

    License

    This plugin is licensed under the GPLv2 or later. See the LICENSE file for more details.

    Contributing

    We welcome contributions to improve this plugin! If you have any suggestions or find any issues, please create a pull request or open an issue on our GitHub repository.

    Acknowledgements

    Special thanks to all contributors and users who have provided feedback and support

    Contact with us

    Feel Free to contact with us

    Releases

    2 releases. Each count is every asset in that release; expand a row for the breakdown.

    Tag
    Published
    Assets
    Downloads
    V.1.0.2 latest
    Jan 27, 2025 1 year ago
    daily-quran-verse-v-1-0-2.zip
    11
    v.1.0
    Nov 19, 2024 1 year ago
    daily-quran-verse.zip
    7

    Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

    C- grade

    Security

    Daily Quran Verse 1.0.2 · audited by WP Registry

    High-severity findings.

    1 high
    Audited release
    1.0.2
    Findings
    1
    Worst severity
    high
    Content hash
    a7c6b41abd1a96591ba606ad…

    Findings

    • high Plugin-update checker uses unregistered domain mosquesofbangladesh.xyz (takeover → malicious zip on plugins.php)

      insecure_config

      check_for_plugin_update() is hooked to admin_init and wp_remote_get()s the hardcoded URL https://mosquesofbangladesh.xyz/upjs/dqv-plugin-update.json on every wp-admin request. As of this audit, nic.xyz WHOIS returns 'The queried object does not exist: DOMAIN NOT FOUND' and DNS is NXDOMAIN — the hostname is not registered. The plugin header Update URI is the same host. After a third party registers the domain and serves JSON, json_decode reads version and download_url. The installed version used in version_compare is the literal string '1.0.1' (comment: 'Replace with your plugin's current version') even though the header Version is 1.0.2, so any remote version greater than 1.0.1 fires add_action('after_plugin_row_<basename>'). That callback prints a core-styled plugin-update-tr with <a href="{download_url}">Download version {version}</a> (esc_url/esc_html, so this is not XSS). The updater does not hook pre_set_site_transient_update_plugins, so WordPress will not one-click install; an administrator still has to download the zip and upload it. That is the UX the notice asks for, and it is sufficient for RCE once the zip is activated. The same wp_remote_get also sends WordPress's default user-agent (WordPress/{version}; {home url}), enumerating every install to whoever holds the domain. Attack: register mosquesofbangladesh.xyz, obtain a TLS cert, host {"version":"9.9.9","download_url":"https://attacker/plugin.zip"}, wait for an admin to open plugins.php.

      daily-quran-verse.php:17,215-262

      Recommendation

      Stop fetching updates from mosquesofbangladesh.xyz. Point Update URI at the GitHub repo (or leave it empty) and either remove check_for_plugin_update() or replace it with a GitHub releases / Plugin Update Checker flow that pins the owner/repo and verifies the zip. Compare against the real header version (not a hardcoded 1.0.1). Do not wp_remote_get on every admin_init; cache with a transient. Until the domain is under the author's control, treat any 'update' notice from it as hostile.

    WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

    Full report on WP Registry →