Swiper.js

Resolved v2theg
(@v2theg)

9 months, 3 weeks ago

I noticed the swiper.js 404 issue also mentioned in this thread.

The resource from “https://hostname.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=6.8.1” was blocked due to MIME type (“text/html”) mismatch (X-Content-Type-Options: nosniff).

We do have the site running through Cloudflare.

The path to the actual file in the elementor plugin should include the version number.

This is path in the console error
/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=6.8.1

But the files are actually in:
/wp-content/plugins/elementor/assets/lib/swiper/v8/swiper.min.js?ver=6.8.1

When I disable the Themesflat plugin, the error about the missing swiper.js file goes away and this line disappears from the page source:

https://www.dropbox.com/scl/fi/bq0b7f7verqnws9in4y9o/Screenshot-2025-06-10-at-11.14.53-AM.png?rlkey=1zmlr786r4f7br3o5g4hpybql&dl=0

It re-appears when TF plugin is reactivated. So it is really Elementor or TF Add-ons?

Should the tf script reference the correct swiper path with the version number in it?

Viewing 9 replies - 1 through 9 (of 9 total)

Plugin Support helpdeskthemesflat
(@helpdeskthemesflat)

9 months, 3 weeks ago

Hi there,

This issue was caused by the add-on being incompatible with the latest version of Elementor. We have reviewed and updated it — please update the plugin to ensure everything works smoothly.
Thank you very much!

Thread Starter v2theg
(@v2theg)

9 months, 3 weeks ago

Thank you for the reply. The Themesflat Add-on installed is v2.2.7. I don’t see the new version available yet, so maybe it is in review by WordPress still.

Plugin Support helpdeskthemesflat
(@helpdeskthemesflat)

9 months, 3 weeks ago

Hi there,

The new version is 2.2.7 updated 2 days ago https://prnt.sc/2oAb7k7SrAv1

Thank you

Thread Starter v2theg
(@v2theg)

9 months, 3 weeks ago

Ah, OK. The site may have already updated the plugin itself. I know this is a low priority

but will this be patched soon?

https://patchstack.com/database/wordpress/plugin/themesflat-addons-for-elementor/vulnerability/wordpress-themesflat-addons-for-elementor-plugin-2-2-5-cross-site-scripting-xss-vulnerability?_a_id=350

Plugin Support helpdeskthemesflat
(@helpdeskthemesflat)

9 months, 3 weeks ago

Hi there,

I saw in the link that the date is from March 31, 2025: https://prnt.sc/gAxTYtmUoB2f
We already fixed this issue in earlier versions, when WordPress first issued the warning.

Thread Starter v2theg
(@v2theg)

9 months, 2 weeks ago

Hello,

Patchstack (which our plugin management service that does security checks) still thinks it’s an issue since it says <= 2.2.7. Maybe it’s an issue with Patchstack then?

Plugin Support helpdeskthemesflat
(@helpdeskthemesflat)

9 months, 2 weeks ago

Hi there,

Do you have a log file of the error? If so, please share it with us so we can use it to identify and fix the issue. Also, if our plugin had any security vulnerabilities, it wouldn’t be allowed to remain on WordPress.org.

Any existing vulnerability will result in the plugin being disabled by WordPress until the issue is completely fixed.

Thank you.

Thread Starter v2theg
(@v2theg)

9 months, 2 weeks ago

Hello,

There is no log file for the error. I came across the Patchstack link because our nightly security checks shows the plugin has a vulnerability.

So either Patchstack’s database isn’t updated to know the plugin has been patched or the plugin still has the vulnerability right? Based on what you’ve said it sounds like it could be an issue with the Patchstack listing being out of date.

Thread Starter v2theg
(@v2theg)

8 months, 3 weeks ago

Hi,

Just following up on this security issue.

ManageWP (via Patchstack) is still flagging this plugin as having a vulnerability for versions 2.2.7 and below. Is there an issue with Patchstack’s listing or is there still a vulnerability?

https://patchstack.com/database/wordpress/plugin/themesflat-addons-for-elementor/vulnerability/wordpress-themesflat-addons-for-elementor-plugin-2-2-5-cross-site-scripting-xss-vulnerability

Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘Swiper.js’ is closed to new replies.