WP Manifestindependent plugin directory
manifest / content / bs-swiper

bs Swiper WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB #2 in Content & Publishing

WordPress plugin to show posts, child-pages, custom post types or WooCommerce products in a swiper.js carousel in Bootscore theme.

★ 19stars
9.7krelease downloads
≈380active sites
264composer installs
v5.8.13latest · 5mo ago

Install

Download bs-swiper.zip From the v5.8.13 release on GitHub, May 21, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bootscore/bs-swiper/releases/download/v5.8.13/bs-swiper.zip

On Packagist as bootscore/bs-swiper:

composer require bootscore/bs-swiper
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

WordPress plugin to show posts, pages, custom post types or WooCommerce products in a swiper.js carousel in Bootscore theme.

bs-swiper

Installation

  1. Download latest release bs-swiper.zip.
  2. In your admin panel, go to Plugins > and click the Add New button.
  3. Click Upload Plugin and Choose File, then select the Plugin's .zip file. Click Install Now.
  4. Click Activate to use your new Plugin right away.

Usage

Select template you want to use by replacing bs-swiper-* placeholder in shortcode examples.

  • bs-swiper-card shows items in 4 (xxl), 3 (lg), 2 (md) and 1 (sm) column cards.
  • bs-swiper-card-autoplay shows items in 4 (xxl), 3 (lg), 2 (md) and 1 (sm) column cards with autoplay.
  • bs-swiper-hero shows items in a hero slider with auto-slide effect. Items must have a featured-image.
  • bs-swiper-hero-fade shows items in a hero slider with auto-fade effect. Items must have a featured-image.
  • bs-swiper-card-product shows only WooCommerce products in 4 (xxl), 3 (lg), 2 (md) and 1 (sm) column cards.

Posts

Shortcode to show posts by category

[bs-swiper-* type="post" category="cars, boats" order="ASC" orderby="date" posts="6"]

Options

  • category="" - category-slug, multiple categories separated by comma
  • order="" - ASC or DESC
  • orderby="" - date, title, or rand
  • posts="" - amount of posts to show
  • excerpt="false" - hide excerpt
  • tags="false" - hide tags
  • categories="false" - hide categories

Shortcode to show posts by tags

[bs-swiper-* type="post" tax="post_tag" terms="bikes, motorbikes" order="DESC" orderby="date" posts="5"]

Options

  • tax="" - taxonomy (post_tag)
  • terms="" - tags-slug, multiple terms separated by comma
  • order="" - ASC or DESC
  • orderby="" - date, title, or rand
  • posts="" - amount of posts to show
  • excerpt="false" - hide excerpt
  • tags="false" - hide tags
  • categories="false" - hide categories

Shortcode to show single posts by id

[bs-swiper-* type="post" id="1, 15"]

Options

  • id="" - id of post, multiple ids separated by comma
  • excerpt="false" - hide excerpt
  • tags="false" - hide tags
  • categories="false" - hide categories

Pages

Shortcode to show child-pages by parent-page id

[bs-swiper-* type="page" post_parent="21" order="ASC" orderby="title" posts="6"]

Showing child-pages in parent-page is very useful to avoid empty parent-pages.

Options

  • post_parent="" - id of parent page
  • order="" - ASC or DESC
  • orderby="" - date, title, or rand
  • posts="" - amount of pages to show
  • excerpt="false" - hide excerpt

Shortcode to show single pages by id

[bs-* type="page" id="2, 25"]

Options

  • id="" - id of page, multiple ids separated by comma
  • excerpt="false" - hide excerpt

Custom Post Types

Shortcode to show custom-post-types by terms

[bs-swiper-* type="isotope" tax="isotope_category" terms="dogs, cats" order="DESC" orderby="date" posts="5"]

Options:

  • type="" - type of custom-post-type
  • tax="" - taxonomy
  • terms="" - terms-slug, multiple terms separated by comma
  • order="" - ASC or DESC
  • orderby="" - date, title, or rand
  • posts="" - amount of custom post types to show
  • excerpt="false" - hide excerpt

Shortcode to show single custom-post-types by id

[bs-* type="isotope" id="33, 31"]

Options

  • id="" - id of custom-post-type, multiple ids separated by comma
  • excerpt="false" - hide excerpt

WooCommerce Products

Shortcode to show products

[bs-swiper-card-product]

Options:

  • category="cars, boats" - Category slug, multiple categories separated by comma. Will pull products matching these categories (Default: '')
  • id="1, 2, 3" - id of product(s), multiple ids separated by comma. Will show products matching these ids (Default: '')
  • brand="brand1, brand2" - Will pull products matching these brands (Default: '')
  • posts="12" - Specify how many products will be shown (Default: -1)
  • orderby="date" - date, title or rand. Specify how products will be ordered by (Default: date)
  • order="DESC" - Specify if products will be ordered ASC or DESC (Default: DESC)
  • featured="true" - Will pull featured products (Default: false)
  • outofstock="false" - Will hide out of stock products (Default: true)
  • onsale="true" - Will show only onsale products (Default: '')
  • showhidden="true" Shows products hidden from catalog (Default: false)

Bootscore v5.3.1 added a hook to all single-*.php's:

<?php if (function_exists('bootscore_related_posts')) bootscore_related_posts(); ?>

bs Swiper hooks related posts there showing the latest 12 posts from the same category. This means that the category should have at least 4 posts to show the related posts correctly.

Related posts can be removed by adding a filter to child's functions.php:

// Remove related posts
add_filter('bootscore_disable_related_posts', '__return_true');

Or by a single line of CSS:

.related-posts {
  display: none;
}

Overriding templates via theme

Template files can be found within the /bs-swiper/templates/ plugin directory.

Edit files in an upgrade-safe way using overrides. Copy the template into a directory within your theme named /bs-swiper/ keeping the same file structure but removing the /templates/ subdirectory. Path must be /your-theme/bs-swiper/[file].php.

The copied file will now override the bs Swiper template file. Change cards, classes or HTML as you want.

Templates that can be overridden

  • related-posts.php
  • sc-swiper-card.php
  • sc-swiper-card-autoplay.php
  • sc-swiper-card-product.php
  • sc-swiper-hero.php
  • sc-swiper-hero-fade.php

License & Credits

Releases

Newest 25 of 35 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v5.8.13 latest
May 21, 2026 5mo ago
bs-swiper.zip
397
Jan 8, 2026 9mo ago
bs-swiper.zip
379
Sep 1, 2025 1 year ago
bs-swiper.zip
446
May 21, 2025 1 year ago
bs-swiper.zip
357
Apr 16, 2025 1 year ago
bs-swiper.zip
138
Jan 3, 2025 1 year ago
bs-swiper.zip
497
Nov 19, 2024 1 year ago
bs-swiper.zip
201
Sep 13, 2024 2 years ago
bs-swiper.zip
347
Sep 4, 2024 2 years ago
bs-swiper.zip
53
Aug 27, 2024 2 years ago
bs-swiper.zip
52
Aug 15, 2024 2 years ago
bs-swiper.zip
51
Jul 24, 2024 2 years ago
bs-swiper.zip
105
Jul 15, 2024 2 years ago
bs-swiper.zip
59
Jun 6, 2024 2 years ago
bs-swiper.zip
193
Mar 28, 2024 2 years ago
bs-swiper.zip
334
Feb 13, 2024 2 years ago
bs-swiper.zip
234
Jan 16, 2024 2 years ago
bs-swiper.zip
80
Nov 28, 2023 2 years ago
bs-swiper-main.zip
643
Oct 18, 2023 3 years ago
bs-swiper-main.zip
559
Sep 14, 2023 3 years ago
bs-swiper-main.zip
425
Aug 27, 2023 3 years ago
bs-swiper-main.zip
344
Aug 26, 2023 3 years ago
bs-swiper-main.zip
125
Aug 11, 2023 3 years ago
bs-swiper-main.zip
145
Apr 26, 2023 3 years ago
bs-swiper-main.zip
821
Mar 31, 2023 3 years ago
bs-swiper-main.zip
379
All releases on GitHub →

Active-site estimate ≈380 comes from the median of recent superseded releases. Method.

B grade

Security

bs Swiper 5.8.13 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
5.8.13
Findings
1
Worst severity
medium
Content hash
f3b3bd65184079c1a6c85166…

Findings

  • medium Shortcode type attribute queries arbitrary post types, exposing non-public published content

    information_disclosure

    The [bs-swiper-card], [bs-swiper-card-autoplay], [bs-swiper-hero], [bs-swiper-hero-fade], and [bs-swiper-card-product] shortcodes copy the attacker-controlled `type` attribute into WP_Query['post_type'] after only sanitize_text_field(). There is no allowlist of public/publicly_queryable types, no current_user_can() on the target type, and the shortcode_atts `post_status` default is never copied into $options (WP_Query therefore selects public statuses such as publish for whatever type was named). Core WP_Query does not honor publicly_queryable when post_type is explicit, so Contributor+ (edit_posts; Shortcode block / classic editor) can preview or publish e.g. [bs-swiper-card type="shop_coupon"] or type="wp_block" and the templates will print the_title() plus the excerpt for every matching row. That discloses WooCommerce coupon codes, synced-pattern/reusable-block text, and similar non-public CPT bodies to the shortcode author and, once published, to unauthenticated visitors. `tax`/`terms` further filter any taxonomy. Product slider defaults type=product but still accepts an override.

    templates/sc-swiper-card.php:41-93

    Recommendation

    Hard-set post_status to publish (do not take it from shortcode atts). Restrict `type` to get_post_types(array('public' => true)) plus an explicit product allowlist for the product shortcode; reject unknown types. For [bs-swiper-card-product], hardcode post_type=product and ignore a supplied type. Optionally require current_user_can on the post type's read cap before querying non-public types.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.