Shortcodes Ultimate – Content Elements

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 32% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ LegalTech

   1mo ago

   The plugin works great for me, and it’s quite useful. Thanks for providing it!

   Read on wp.org ↗
2. ★★★★★ bguezel

   1mo ago

   Application que j utilise sur mon site

   Read on wp.org ↗
3. ★★★★★ winsynergy

   3mo ago

   A plugin that is actually working and easy to use.

   Read on wp.org ↗
4. ★★★★★ LD

   3mo ago

   Nothing like starting my day fixing numerous completely broken websites because of this plugin. I went through all the sites page by page to replace any remaining shortcodes, and then deleted the plugin entirely. Hours of unpaid work, but I feel better knowing the plugin is gone from all of my sites. Don’t recommend.

   Read on wp.org ↗
5. ★★★★★ agenceneoh

   3mo ago

   Careful do not update this plugin to 7.5.1 until they fix it, it causes a fatal error!

   Read on wp.org ↗
6. ★★★★★ iDesi Media

   3mo ago

   Great plugin!!! This topic was modified 2 months ago by iDesi Media.

   Read on wp.org ↗
7. ★★★★★ tloving

   4mo ago

   So many quick fixes using these short codes that make it easy!

   Read on wp.org ↗
8. ★★★★★ rhettfinck

   5mo ago

   Very convenient and helpful Plugin

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.8.2 Fixed a JavaScript error ( _prelude.js:1 Uncaught Error: Cannot find module '5' ) that could prevent shortcodes from working. Sorry for the inconvenience this caused. Fixed an issue where the Spacer shortcode was not dis 7.8.2
2. — Version 7.8.0 Added Countdown Timer , a new Pro shortcode for creating high-impact launch, sale, event, and deadline timers. It helps draw attention to time-sensitive offers with animated digits, flexible date and time settings, custo 7.8.0
3. — Version 7.7.0 Added Posts Grid , a new Pro shortcode for building friendly, responsive post layouts with less setup. Use it to query posts, pages, or custom post types; narrow results by taxonomy terms, authors, included or excluded p 7.7.0
4. — Version 7.6.4 Big update for the Shortcode Generator tool! I’ve improved the tool to make it even easier and more pleasant to use. It now includes an always-visible live preview, a grouped list of shortcodes, a reset settings button, 7.6.4
5. — Version 7.5.3 Fixed issue with missing /freemius/ folder 7.5.3
6. — Version 7.5.1 Tested with WordPress 7.0 Updated Freemius SDK 7.5.1

39 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.3.3 Patched in 7.3.4
2. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode ↗
   2026-04-15 CVE-2026-3885 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.9 Patched in 7.5.0
3. Medium · 6.4 Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode ↗
   2026-04-03 CVE-2026-0738 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.8 Patched in 7.4.9
4. Medium · 6.4 Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode ↗
   2026-04-03 CVE-2026-0737 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.7 Patched in 7.4.8
5. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute ↗
   2026-03-31 CVE-2026-2480 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.10 Patched in 7.5.0
6. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery ↗
   2025-11-23 CVE-2025-12800 Server-Side Request Forgery (SSRF) Affects <= 7.4.5 Patched in 7.4.6
7. Medium · 6.4 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link ↗
   2025-07-21 CVE-2025-8015 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.2 Patched in 7.4.3
8. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ↗
   2025-07-20 CVE-2025-7354 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.2 Patched in 7.4.3
9. Medium · 6.1 Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution ↗
   2025-07-20 CVE-2025-7369 Cross-Site Request Forgery (CSRF) Affects <= 7.4.2 Patched in 7.4.3
10. Medium · 6.4 Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute ↗
    2025-07-03 CVE-2025-5567 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.0 Patched in 7.4.1
11. Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library ↗
    2025-07-02 CVE-2024-5647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.2 Patched in 7.4.3
12. Medium · 6.4 Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-06-05 CVE-2025-49244 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.3.5 Patched in 7.4.0
13. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter ↗
    2025-03-03 CVE-2025-0370 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.3.3 Patched in 7.3.4
14. Medium · 5.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ↗
    2024-10-22 CVE-2024-8500 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.2.2 Patched in 7.3.0
15. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode ↗
    2024-06-04 CVE-2024-4821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.6 Patched in 7.1.7
16. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode ↗
    2024-05-20 CVE-2024-4553 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.5 Patched in 7.1.6
17. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-04-29 CVE-2024-3550 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.2 Patched in 7.1.3
18. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox ↗
    2024-04-24 CVE-2024-3548 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.0 Patched in 7.1.2
19. Medium · 6.4 Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-05 CVE-2024-3188 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0.5 Patched in 7.1.0
20. Medium · 6.4 Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode ↗
    2024-03-23 CVE-2024-2583 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0.4 Patched in 7.0.5
21. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode ↗
    2024-02-27 CVE-2024-1808 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0.3 Patched in 7.0.4
22. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode ↗
    2024-02-19 CVE-2024-1510 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0.2 Patched in 7.0.3
23. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2024-02-07 CVE-2024-0792 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0.1 Patched in 7.0.2
24. Medium · 5.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-18 CVE-2023-6488 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0.0 Patched in 7.0.1
25. Medium · 4.3 WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure ↗
    2023-11-27 CVE-2023-6226 Authorization Bypass Through User-Controlled Key Affects <= 5.13.3 Patched in 7.0.0
26. Medium · 6.4 WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-11-27 CVE-2023-6225 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.13.3 Patched in 7.0.0
27. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 5.12.5 - 5.13.0 Patched in 5.13.1
28. Medium · 6.5 Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure ↗
    2023-02-27 CVE-2023-0911 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.12.7 Patched in 5.12.8
29. Medium · 4.3 Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode ↗
    2023-02-27 CVE-2023-0890 Authorization Bypass Through User-Controlled Key Affects <= 5.12.7 Patched in 5.12.8
30. Medium · 6.5 Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode ↗
    2023-02-10 CVE-2023-25050 External Control of File Name or Path Affects <= 5.12.6 Patched in 5.12.7
31. Medium · 6.5 Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery ↗
    2023-02-10 CVE-2023-23800 Server-Side Request Forgery (SSRF) Affects <= 5.12.6 Patched in 5.12.7
32. Medium · 6.4 Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting ↗
    2023-02-10 CVE-2023-25040 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.12.6 Patched in 5.12.7
33. Medium · 6.4 Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2022-10-13 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.12.0 Patched in 5.12.1
34. High · 8.8 Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery ↗
    2022-10-13 CVE-2022-41136 Cross-Site Request Forgery (CSRF) Affects <= 5.12.0 Patched in 5.12.1
35. High · 8.8 Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery ↗
    2022-10-02 CVE-2022-38086 Cross-Site Request Forgery (CSRF) Affects <= 5.12.0 Patched in 5.12.1
36. Medium · 5.4 WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2021-08-23 CVE-2021-24525 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.10.2 Patched in 5.10.2
37. High · 8.8 WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution ↗
    2017-10-31 CVE-2017-18580 Improper Control of Generation of Code ('Code Injection') Affects < 5.0.1 Patched in 5.0.1
38. Medium · 5.0 WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal ↗
    2017-06-23 CVE-2017-2245 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 4.10.0 Patched in 4.10.0
39. Medium · 6.1 WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting ↗
    2015-05-05 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.3 Patched in 4.9.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 71 languages, 16 at 90% or more

Plus 47 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-12-02 500K+ → 400K+ down after 495 days in tier
2. 2024-07-25 600K+ → 500K+ down after 426 days in tier
3. 2023-05-26 700K+ → 600K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Column Shortcodes 60K+ installs · 4.7★ · 2 shared tags D
• Lightbox for Gallery & Image Block 20K+ installs · 4.9★ · 2 shared tags A
• Meks Flexible Shortcodes 10K+ installs · 4.0★ · 2 shared tags C
• C Contact Form 7 Shortcode Enabler 10K+ installs · 4.4★ · 2 shared tags C
• WP Date and Time Shortcode 10K+ installs · 4.6★ · 2 shared tags A
• Bootstrap Shortcodes 4K+ installs · 4.6★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Shortcodes Ultimate – Content Elements into a readme, a review or a deck. It updates itself.

Shortcodes Ultimate – Content Elements: 400K+ active installs, 4.9★ (5,924 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/shortcodes-ultimate