WP Manifestindependent plugin directory
manifest / content / bs-grid

bs Grid WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB #5 in Content & Publishing

WordPress plugin to show posts, child-pages or custom post types in grid / list cards or heroes in Bootscore theme.

★ 6stars
7.6krelease downloads
≈360active sites
66composer installs
v5.8.1latest · 5mo ago

Install

Download bs-grid.zip From the v5.8.1 release on GitHub, May 21, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bootscore/bs-grid/releases/download/v5.8.1/bs-grid.zip

On Packagist as bootscore/bs-grid:

composer require bootscore/bs-grid
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

WordPress plugin to show posts, pages or custom-post-types in grid / list cards, heroes, accordion or tabs via shortcode in Bootscore theme.

bs-grid

Installation

  1. Download latest release bs-grid.zip.
  2. In your admin panel, go to Plugins > and click the Add New button.
  3. Click Upload Plugin and Choose File, then select the Plugin's .zip file. Click Install Now.
  4. Click Activate to use your new Plugin right away.

Usage

Select template you want to use by replacing bs-* placeholder in shortcode examples.

[bs-grid]
  • bs-grid shows items in 4 (xxl), 3 (lg), 2 (md) and 1 (sm) column cards.
  • bs-list shows items in 1 column vertical cards (md) and flip into 1 column horizontal cards (lg).
  • bs-hero shows hero items with background-images.
  • bs-accordion shows items with full content in a Bootstrap accordion.
  • bs-tabs shows items with full content in Bootstrap tabs.

Posts

Shortcode to show posts by category

[bs-* type="post" category="cars, boats" order="ASC" orderby="date" posts="6"]

Options

  • category="" category-slug, multiple categories separated by comma
  • order="" ASC or DESC
  • orderby="" date, title, or rand
  • posts="" amount of posts
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt
  • tags="false" hide tags
  • categories="false" hide categories

Shortcode to show posts by tags

[bs-* type="post" tax="post_tag" terms="bikes, motorbikes" order="DESC" orderby="date" posts="5"]

Options

  • tax="" taxonomy (post_tag)
  • terms="" tags-slug, multiple terms separated by comma
  • order="" ASC or DESC
  • orderby="" date, title, or rand
  • posts="" amount of posts
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt
  • tags="false" hide tags
  • categories="false" hide categories

Shortcode to show single posts by id

[bs-* type="post" id="1, 15"]

Options

  • id="" post id, multiple ids separated by comma
  • order="" ASC or DESC
  • orderby="" date, title, or rand
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt
  • tags="false" hide tags
  • categories="false" hide categories

Pages

Shortcode to show child-pages by parent-page id

[bs-* type="page" post_parent="21" order="ASC" orderby="title" posts="6"]

Showing child-pages in parent-page is very useful to avoid empty parent-pages.

Options

  • post_parent="" parent-page id
  • order="" ASC or DESC
  • orderby="" date, title, or rand
  • posts="" amount of pages
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt

Shortcode to show single pages by id

[bs-* type="page" id="2, 25"]

Options

  • id="" page id, multiple ids separated by comma
  • order="" ASC or DESC
  • orderby="" date, title, or rand
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt

Custom Post Types

Shortcode to show custom-post-types by terms

[bs-* type="isotope" tax="isotope_category" terms="dogs, cats" order="DESC" orderby="date" posts="5"]

Options:

  • type="" type of custom-post-type
  • tax="" taxonomy
  • terms="" terms-slug, multiple terms separated by comma
  • order="" ASC or DESC
  • orderby="" date, title, or rand
  • posts="" amount of custom-post-types
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt

Shortcode to show single custom-post-types by id

[bs-* type="isotope" id="33, 31"]

Options

  • id="" custom-post-type's id, multiple ids separated by comma
  • order="" ASC or DESC
  • orderby="" date, title, or rand
Additional options bs-grid, bs-list and bs-hero
  • excerpt="false" hide excerpt

Overriding templates via theme

Template files can be found within the /bs-grid-main/templates/ plugin directory.

Edit files in an upgrade-safe way using overrides. Copy the template into a directory within your theme named /bs-grid/ keeping the same file structure but removing the /templates/ subdirectory. Path must be /your-theme/bs-grid/[file].php.

The copied file will now override the bs Grid template file. Change cards, classes or HTML as you want.

Templates that can be overridden

  • sc-grid.php
  • sc-list.php
  • sc-hero.php
  • sc-accordion.php
  • sc-tabs.php

License & Credits

Releases

20 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v5.8.1 latest
May 21, 2026 5mo ago
bs-grid.zip
348
Jan 12, 2026 9mo ago
bs-grid.zip
283
Apr 16, 2025 1 year ago
bs-grid.zip
712
Aug 31, 2024 2 years ago
bs-grid.zip
971
Jun 6, 2024 2 years ago
bs-grid.zip
364
Mar 28, 2024 2 years ago
bs-grid.zip
302
Jan 17, 2024 2 years ago
bs-grid.zip
270
Nov 30, 2023 2 years ago
bs-grid-main.zip
535
Sep 19, 2023 3 years ago
bs-grid-main.zip
605
Aug 27, 2023 3 years ago
bs-grid-main.zip
345
Aug 26, 2023 3 years ago
bs-grid-main.zip
152
Jun 8, 2023 3 years ago
bs-grid-main.zip
105
Apr 26, 2023 3 years ago
bs-grid-main.zip
449
Mar 31, 2023 3 years ago
bs-grid-main.zip
371
Dec 6, 2022 3 years ago
bs-grid-main.zip
771
Jul 4, 2022 4 years ago
bs-grid-main.zip
746
Jun 28, 2022 4 years ago
bs-grid-main.zip
125
Jan 10, 2022 4 years ago
bs-grid-main.zip
91
Sep 14, 2021 5 years ago
bs-grid-main.zip
9
Sep 13, 2021 5 years ago
bs5-post-page-grid-list.zip
13

Active-site estimate ≈360 comes from the median of recent superseded releases. Method.

B grade

Security

bs Grid 5.8.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
5.8.1
Findings
1
Worst severity
medium
Content hash
013131857f8749edcd8600ce…

Findings

  • medium Shortcode type= queries non-viewable post types and dumps their content

    information_disclosure

    All five shortcodes (bs-grid, bs-list, bs-hero, bs-accordion, bs-tabs) pass sanitize_text_field($atts['type']) straight into WP_Query as post_type with no is_post_type_viewable() / public / capability check and no allowlist. shortcode_atts includes post_status=publish but that value is never copied into $options, so the query uses WP_Query's empty-post_status frontend rules (public statuses such as publish; private only for users with read_private_posts or who own the post). That blocks drafts, but it still returns any CPT whose rows are status=publish even when the type is public=false (core wp_block, wp_navigation, wp_template, wp_global_styles; WooCommerce shop_coupon). Accordion and tabs then call the_content() on each row, so a Contributor/Author who can publish a post containing [bs-tabs type="wp_block"] (or type="shop_coupon") exposes those bodies/titles to every visitor. Grid/list/hero leak titles and esc_html excerpts of the same sets. This is the bypass of REST permission checks on /wp/v2/blocks. id= only int-casts IDs and does not add a viewability check.

    templates/sc-accordion.php:40-103

    Recommendation

    Copy post_status => 'publish' into the WP_Query args (do not take it from shortcode attributes). Reject post types that fail is_post_type_viewable() unless the current user can read that type. Keep type/id/tax/terms as display filters only after that gate. Accordion/tabs should still not render posts the visitor cannot read.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.