Shortcodes Ultimate – Content Elements

87 Quality Score

Active Installs

25/30

With 400,000 active installs, it sits comfortably in the mid-tier range of widely used plugins, though it is far from a household name like Yoast or Akismet.

Update Freshness

25/25

The plugin was updated on June 10, 2026, has been tested with WordPress 7.0, and requires PHP 7.0 or higher, indicating active and current maintenance.

User Rating

15/15

A 98 out of 100 rating from 5,923 users is exceptionally high and suggests broad user satisfaction.

Support Health

8/15

With 19 of 22 support threads resolved, an 86.4% resolution rate is solid though the small absolute number of threads is worth noting.

WP Compatibility

15/15

Tested against WordPress 7.0 with a minimum requirement of 6.0 and PHP 7.0, compatibility is current and forward-looking.

Scores higher than 98% of indexed plugins

About

Add 50+ shortcodes with live preview for tabs, accordions, buttons, FAQs, sliders and boxes. Works in Block Editor and Classic Editor.

Active Installs 400k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-25 1:50pm GMT

Requires WordPress 6.0+

Tested Up To 7.1.2

Requires PHP 7.0+

Security History

39 known vulnerabilities, all patched

3 High 36 Medium

Most recent: April 30, 2026

View details ▸

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Medium

April 30, 2026 Patched in ["7.3.4"] CVE-2024-13362

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode Medium

April 15, 2026 Patched in ["7.5.0"] CVE-2026-3885

Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode Medium

April 3, 2026 Patched in ["7.4.9"] CVE-2026-0738

Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode Medium

April 3, 2026 Patched in ["7.4.8"] CVE-2026-0737

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute Medium

March 31, 2026 Patched in ["7.5.0"] CVE-2026-2480

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery Medium

November 23, 2025 Patched in ["7.4.6"] CVE-2025-12800

Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link Medium

July 21, 2025 Patched in ["7.4.3"] CVE-2025-8015

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes Medium

July 20, 2025 Patched in ["7.4.3"] CVE-2025-7354

Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution Medium

July 20, 2025 Patched in ["7.4.3"] CVE-2025-7369

Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute Medium

July 3, 2025 Patched in ["7.4.1"] CVE-2025-5567

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library Medium

July 2, 2025 Patched in ["7.4.3"] CVE-2024-5647

Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 5, 2025 Patched in ["7.4.0"] CVE-2025-49244

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter Medium

March 3, 2025 Patched in ["7.3.4"] CVE-2025-0370

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Medium

October 22, 2024 Patched in ["7.3.0"] CVE-2024-8500

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode Medium

June 4, 2024 Patched in ["7.1.7"] CVE-2024-4821

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode Medium

May 20, 2024 Patched in ["7.1.6"] CVE-2024-4553

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

April 29, 2024 Patched in ["7.1.3"] CVE-2024-3550

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Medium

April 24, 2024 Patched in ["7.1.2"] CVE-2024-3548

Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

April 5, 2024 Patched in ["7.1.0"] CVE-2024-3188

Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode Medium

March 23, 2024 Patched in ["7.0.5"] CVE-2024-2583

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode Medium

February 27, 2024 Patched in ["7.0.4"] CVE-2024-1808

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode Medium

February 19, 2024 Patched in ["7.0.3"] CVE-2024-1510

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Medium

February 7, 2024 Patched in ["7.0.2"] CVE-2024-0792

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

December 18, 2023 Patched in ["7.0.1"] CVE-2023-6488

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure Medium

November 27, 2023 Patched in ["7.0.0"] CVE-2023-6226

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

November 27, 2023 Patched in ["7.0.0"] CVE-2023-6225

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["5.13.1"] CVE-2023-33999

Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure Medium

February 27, 2023 Patched in ["5.12.8"] CVE-2023-0911

Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode Medium

February 27, 2023 Patched in ["5.12.8"] CVE-2023-0890

Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode Medium

February 10, 2023 Patched in ["5.12.7"] CVE-2023-25050

Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery Medium

February 10, 2023 Patched in ["5.12.7"] CVE-2023-23800

Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting Medium

February 10, 2023 Patched in ["5.12.7"] CVE-2023-25040

Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

October 13, 2022 Patched in ["5.12.1"]

Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery High

October 13, 2022 Patched in ["5.12.1"] CVE-2022-41136

Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery High

October 2, 2022 Patched in ["5.12.1"] CVE-2022-38086

WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

August 23, 2021 Patched in ["5.10.2"] CVE-2021-24525

WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution High

October 31, 2017 Patched in ["5.0.1"] CVE-2017-18580

WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal Medium

June 23, 2017 Patched in ["4.10.0"] CVE-2017-2245

WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting Medium

May 5, 2015 Patched in ["4.9.4"]

What It Does

Shortcodes Ultimate adds a library of over 50 reusable content elements such as tabs, accordions, buttons, sliders, lightboxes, and FAQ boxes that can be inserted anywhere on a WordPress site. It works inside both the Block Editor and the Classic Editor, and includes a live preview window so you can see how a shortcode will look before inserting it.

Who It's For

This plugin is best for site owners and content creators who want to drop in polished, interactive elements like comparison boxes, pricing tables, and carousels without learning a full page builder. It fits well with content marketing agencies, course creators, freelancers, and small businesses that need visual components but prefer a lightweight approach to heavier builders like Elementor or Divi.

Who Should Skip It

If you already use a full page builder such as Elementor, Beaver Builder, or Divi, you will find most of these components already built in and should skip this plugin. Developers who prefer writing custom blocks or ACF Pro fields will also get little value from a third-party shortcode library.

The Bottom Line

Shortcodes Ultimate earns a 92.74 overall quality score and lives up to its reputation as a reliable, well-maintained Swiss Army knife of content elements. It is a strong choice for site owners who want quick visual components without the overhead of a full page builder, though heavy builder users and block-purist developers can safely skip it. The 98 out of 100 user rating across nearly 6,000 reviews makes this one of the higher-trust options in its category.

Choose this if you want full starter site templates rather than individual shortcode elements.

PublishPress Blocks – Block Controls, Block Visibility, Block Permissions 88/100

Pick this if you need editor-level controls like block visibility and permissions rather than a shortcode library.

Disable Gutenberg 88/100

Pick this if your goal is the opposite of Shortcodes Ultimate and you want to disable the Block Editor entirely.

Advanced Editor Tools 86/100

Choose this if you mainly want a richer Classic Editor toolbar and not a content element library.

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns 86/100

Pick this if you prefer native Gutenberg blocks over shortcodes for building content.