Plugin Pulse Beta
← Pulse

Shortcodes Ultimate – Content Elements

by Vova · Blocks

Also makes 5 other plugins · 400.1K+ installs across the portfolio →

Try it live ↗ wp.org ↗

Add 50+ shortcodes with live preview for tabs, accordions, buttons, FAQs, sliders and boxes. Works in Block Editor and Classic Editor.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

Health

A 92/100

no flags

Active installs

400K+

≈450K estimated

Momentum

+20%

downloads vs prior 30d

Biggest opportunity: Swap “block editor”, “carousel” and “lightbox” for “spoiler”, “reusable” and “ui”. “block editor” isn't earning its slot: you're not in the first 24 results for its own search. “spoiler” sits at #4 untagged, close enough for a declared tag to move it up. “carousel” isn't earning its slot: you're not in the first 24 results for its own search. “reusable” sits at #5 untagged, close enough for a declared tag to move it up. “lightbox” isn't earning its slot: you're not in the first 24 results for its own search. “ui” sits at #5 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.

See the detail → Get the free audit
How scoring works →
92 Health · A
Maintenance 100/100
Rating quality 98/100
Support 70/100
Security 90/100

92 health vs 71 average across 2,524 Blocks plugins

400K+

Active installs

≈450K estimated

26.3M

Total downloads

since 2011 · 1.5% still active

4.9/5

Rating

5,925 reviews

+20%

233K

Downloads · 30d

category median +15%

Install conversion

How it's measured →

1.5%

of downloads still active

At least 400K of 26.3M lifetime downloads are still running, below its category: the median Blocks plugin keeps 2.1%, across 1,579 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Blocks plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 19 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 5925 reviews

Read on wp.org ↗
5★
5528 4★
276 3★
43 2★
21 1★
57

Details

Version
7.9.2
Last updated
14d ago
Added
2011-04-06 · 15 yrs old
Requires WP
6.0
Tested up to
7.1.4
Requires PHP
7.0
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

92 / 100

Excellent listing optimization

Most to gain: Support resolution

Update recency 100/100

Updated 14 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 98/100

4.9★ over 5,925 reviews, smoothed to 4.89★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 50/100

1 of 2 support threads resolved in the last 2 months

To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.

Get the full rank-higher report →

Daily downloads

Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive

+20% vs prior 30d
3.6K31 Oct 2026

30-day downloads

Rolling 30-day volume · peak 736.4K · peaks are release surges

230.4K31 Oct 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Shortcodes Ultimate · #147youBetter Font Awesome · #630Column Shortcodes · #659Lightbox for Gallery · #1296

Health trend

Composite health score, snapshotted daily

9231 Oct 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

57631 Oct 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

19

releases in the last 12 months

14d ago

latest release · v7.9.2 · 17 Oct 2026

220

tagged releases on record

Recent releases

7.9.2 · 17 Oct 20267.9.1 · 25 Sep 20267.9.0 · 13 Sep 20267.8.4 · 24 Jul 20267.8.2 · 10 Jun 20267.8.1 · 8 Jun 20267.8.0 · 8 Jun 20267.7.0 · 6 Jun 20267.6.4 · 3 Jun 20267.6.3 · 3 Jun 20267.6.2 · 3 Jun 20267.6.1 · 3 Jun 20267.6.0 · 3 Jun 20267.5.3 · 19 May 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v7.8 32%
v7.4 15%
v7.5 11%
v5.12 6.6%
v7.3 6.4%
Older / other versions 28%

Estimated active installs

The public count shows “400K+”. Our estimate pins where the real number sits.

tracked estimate
400K–500K ≈450K

Crossed into this band 11 months ago; the previous band took 17 months to cross, which places it about 50% of the way through.

Install history since 1 Oct 2021

400K31 Oct 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ LegalTech
    4mo ago

    The plugin works great for me, and it’s quite useful. Thanks for providing it!

    Read on wp.org ↗
  2. ★★★★★ bguezel
    4mo ago

    Application que j utilise sur mon site

    Read on wp.org ↗
  3. ★★★★★ winsynergy
    5mo ago

    A plugin that is actually working and easy to use.

    Read on wp.org ↗
  4. ★★★★★ LD
    6mo ago

    Nothing like starting my day fixing numerous completely broken websites because of this plugin. I went through all the sites page by page to replace any remaining shortcodes, and then deleted the plugin entirely. Hours of unpaid work, but I feel better knowing the plugin is gone from all of my sites. Don’t recommend.

    Read on wp.org ↗
  5. ★★★★★ agenceneoh
    6mo ago

    Careful do not update this plugin to 7.5.1 until they fix it, it causes a fatal error!

    Read on wp.org ↗
  6. ★★★★★ iDesi Media
    6mo ago

    Great plugin!!! This topic was modified 2 months ago by iDesi Media.

    Read on wp.org ↗
  7. ★★★★★ tloving
    6mo ago

    So many quick fixes using these short codes that make it easy!

    Read on wp.org ↗
  8. ★★★★★ rhettfinck
    7mo ago

    Very convenient and helpful Plugin

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. — Version 7.8.2 Fixed a JavaScript error ( _prelude.js:1 Uncaught Error: Cannot find module '5' ) that could prevent shortcodes from working. Sorry for the inconvenience this caused. Fixed an issue where the Spacer shortcode was not dis 7.8.2
  2. — Version 7.8.0 Added Countdown Timer , a new Pro shortcode for creating high-impact launch, sale, event, and deadline timers. It helps draw attention to time-sensitive offers with animated digits, flexible date and time settings, custo 7.8.0
  3. — Version 7.7.0 Added Posts Grid , a new Pro shortcode for building friendly, responsive post layouts with less setup. Use it to query posts, pages, or custom post types; narrow results by taxonomy terms, authors, included or excluded p 7.7.0
  4. — Version 7.6.4 Big update for the Shortcode Generator tool! I’ve improved the tool to make it even easier and more pleasant to use. It now includes an always-visible live preview, a grouped list of shortcodes, a reset settings button, 7.6.4
  5. — Version 7.5.3 Fixed issue with missing /freemius/ folder 7.5.3
  6. — Version 7.5.1 Tested with WordPress 7.0 Updated Freemius SDK 7.5.1

Security history

via Wordfence Intelligence

All 39 disclosed vulnerabilities are patched in the current version (7.9.2). Sites still on an older version should update.

  1. Patched Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
    2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation Affects <= 7.3.3 Patched in 7.3.4
  2. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode ↗
    2026-04-15 CVE-2026-3885 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.9 Patched in 7.5.0
  3. Patched Medium · 6.4 Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode ↗
    2026-04-03 CVE-2026-0738 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.8 Patched in 7.4.9
  4. Patched Medium · 6.4 Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode ↗
    2026-04-03 CVE-2026-0737 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.7 Patched in 7.4.8
  5. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute ↗
    2026-03-31 CVE-2026-2480 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.10 Patched in 7.5.0
  6. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery ↗
    2025-11-23 CVE-2025-12800 Server-Side Request Forgery Affects <= 7.4.5 Patched in 7.4.6
  7. Patched Medium · 6.4 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link ↗
    2025-07-21 CVE-2025-8015 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.2 Patched in 7.4.3
  8. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ↗
    2025-07-20 CVE-2025-7354 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.2 Patched in 7.4.3
  9. Patched Medium · 6.1 Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution ↗
    2025-07-20 CVE-2025-7369 Cross-Site Request Forgery Affects <= 7.4.2 Patched in 7.4.3
  10. Patched Medium · 6.4 Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute ↗
    2025-07-03 CVE-2025-5567 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.0 Patched in 7.4.1
  11. Patched Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library ↗
    2025-07-02 CVE-2024-5647 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.2 Patched in 7.4.3
  12. Patched Medium · 6.4 Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-06-05 CVE-2025-49244 Improper Neutralization of Input During Web Page Generation Affects <= 7.3.5 Patched in 7.4.0
  13. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter ↗
    2025-03-03 CVE-2025-0370 Improper Neutralization of Input During Web Page Generation Affects <= 7.3.3 Patched in 7.3.4
  14. Patched Medium · 5.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ↗
    2024-10-22 CVE-2024-8500 Improper Neutralization of Input During Web Page Generation Affects <= 7.2.2 Patched in 7.3.0
  15. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode ↗
    2024-06-04 CVE-2024-4821 Improper Neutralization of Input During Web Page Generation Affects <= 7.1.6 Patched in 7.1.7
  16. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode ↗
    2024-05-20 CVE-2024-4553 Improper Neutralization of Input During Web Page Generation Affects <= 7.1.5 Patched in 7.1.6
  17. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-04-29 CVE-2024-3550 Improper Neutralization of Input During Web Page Generation Affects <= 7.1.2 Patched in 7.1.3
  18. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox ↗
    2024-04-24 CVE-2024-3548 Improper Neutralization of Input During Web Page Generation Affects <= 7.1.0 Patched in 7.1.2
  19. Patched Medium · 6.4 Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-05 CVE-2024-3188 Improper Neutralization of Input During Web Page Generation Affects <= 7.0.5 Patched in 7.1.0
  20. Patched Medium · 6.4 Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode ↗
    2024-03-23 CVE-2024-2583 Improper Neutralization of Input During Web Page Generation Affects <= 7.0.4 Patched in 7.0.5
  21. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode ↗
    2024-02-27 CVE-2024-1808 Improper Neutralization of Input During Web Page Generation Affects <= 7.0.3 Patched in 7.0.4
  22. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode ↗
    2024-02-19 CVE-2024-1510 Improper Neutralization of Input During Web Page Generation Affects <= 7.0.2 Patched in 7.0.3
  23. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2024-02-07 CVE-2024-0792 Improper Neutralization of Input During Web Page Generation Affects <= 7.0.1 Patched in 7.0.2
  24. Patched Medium · 5.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-18 CVE-2023-6488 Improper Neutralization of Input During Web Page Generation Affects <= 7.0.0 Patched in 7.0.1
  25. Patched Medium · 4.3 WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure ↗
    2023-11-27 CVE-2023-6226 Authorization Bypass Through User-Controlled Key Affects <= 5.13.3 Patched in 7.0.0
  26. Patched Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-11-27 CVE-2023-6225 Improper Neutralization of Input During Web Page Generation Affects <= 5.13.3 Patched in 7.0.0
  27. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects 5.12.5 - 5.13.0 Patched in 5.13.1
  28. Patched Medium · 6.5 Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure ↗
    2023-02-27 CVE-2023-0911 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.12.7 Patched in 5.12.8
  29. Patched Medium · 4.3 Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode ↗
    2023-02-27 CVE-2023-0890 Authorization Bypass Through User-Controlled Key Affects <= 5.12.7 Patched in 5.12.8
  30. Patched Medium · 6.5 Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode ↗
    2023-02-10 CVE-2023-25050 External Control of File Name or Path Affects <= 5.12.6 Patched in 5.12.7
  31. Patched Medium · 6.5 Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery ↗
    2023-02-10 CVE-2023-23800 Server-Side Request Forgery Affects <= 5.12.6 Patched in 5.12.7
  32. Patched Medium · 6.4 Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting ↗
    2023-02-10 CVE-2023-25040 Improper Neutralization of Input During Web Page Generation Affects <= 5.12.6 Patched in 5.12.7
  33. Patched Medium · 6.4 Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2022-10-13 Improper Neutralization of Input During Web Page Generation Affects <= 5.12.0 Patched in 5.12.1
  34. Patched High · 8.8 Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery ↗
    2022-10-13 CVE-2022-41136 Cross-Site Request Forgery Affects <= 5.12.0 Patched in 5.12.1
  35. Patched High · 8.8 Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery ↗
    2022-10-02 CVE-2022-38086 Cross-Site Request Forgery Affects <= 5.12.0 Patched in 5.12.1
  36. Patched Medium · 5.4 WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2021-08-23 CVE-2021-24525 Improper Neutralization of Input During Web Page Generation Affects < 5.10.2 Patched in 5.10.2
  37. Patched High · 8.8 WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution ↗
    2017-10-31 CVE-2017-18580 Improper Control of Generation of Code Affects < 5.0.1 Patched in 5.0.1
  38. Patched Medium · 5.0 WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal ↗
    2017-06-23 CVE-2017-2245 Improper Limitation of a Pathname to a Restricted Directory Affects < 4.10.0 Patched in 4.10.0
  39. Patched Medium · 6.1 WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting ↗
    2015-05-05 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.3 Patched in 4.9.4

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

✓ Low memory footprint
✓ Low page-speed impact
✕ Runs on latest PHP + WP
✕ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✓ No external HTTP errors
✓ Optimized database use
✓ Frequently updated

Languages

via translate.wordpress.org

Translated into 71 languages, 12 at 90% or more

Dutch 100%
Dutch (Belgium) 100%
Dutch (Formal) 100%
Galician 100%
Serbian 100%
Spanish (Spain) 100%
Spanish (Chile) 99%
Japanese 94%
Korean 94%
Russian 94%
German 90%
Hindi 90%
German (Formal) 88%
Polish 87%
Spanish (Colombia) 87%
Spanish (Venezuela) 87%
Spanish (Ecuador) 86%
English (South Africa) 85%
Spanish (Mexico) 82%
Chinese (China) 78%
French (France) 74%
English (UK) 73%
English (Australia) 66%
English (Canada) 66%

Plus 47 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Premium

Share of voice

How often each assistant names Shortcodes Ultimate when asked about this topic, where it comes in the answer, and how that compares with its wp.org search position. Latest run 25 Oct 2026.

Assistants
ChatGPT, Claude
Topics tracked
Table of contents
Get early access to Premium →

Readme readiness

8 of 8 pass · checked 25 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ✓ Says what it does "Add 50+ shortcodes with live preview for tabs, accordions, buttons, FAQs, sliders and boxes. Works in Block..."
  • ✓ Has a FAQ 10 questions in the FAQ.
  • ✓ FAQ asks real questions 10 of 10 read like questions a user would type.
  • ✓ Names who it is for Names its audience or use cases ("ideal for", "who want", "who need").
  • ✓ Names what it works with Mentions Elementor, Gutenberg, Block editor.
  • ✓ Headings and lists 8 headings and 5 lists.
  • ✓ Enough to quote 3,872 characters of description.
  • ✓ Tags match the text All 5 tags appear in the text.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2025-12-02 500K+ → 400K+ down after 495 days in tier
  2. 2024-07-25 600K+ → 500K+ down after 426 days in tier
  3. 2023-05-26 700K+ → 600K+ down after 420 days in tier
  4. 2022-04-01 800K+ → 700K+ down after 1217 days in tier
  5. 2018-12-01 700K+ → 800K+ up after 423 days in tier
  6. 2017-10-04 600K+ → 700K+ up after 368 days in tier
  7. 2016-10-01 500K+ → 600K+ up after 210 days in tier
  8. 2016-03-05 400K+ → 500K+ up after 208 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Shortcodes Ultimate – Content Elements into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/shortcodes-ultimate" width="480" height="300" style="border:0" loading="lazy" title="Shortcodes Ultimate – Content Elements — Plugin Pulse"></iframe>
Preview card ↗

Shortcodes Ultimate – Content Elements: 400K+ active installs, 4.9★ (5,925 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/shortcodes-ultimate

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.