Skip to content
PluginCanary

Shortcodes Ultimate - Content Elements

by Vova · 400,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: 13 vulnerabilities published in the last 24 months.

83/ 100 Canary Score
Sub-scores for Shortcodes Ultimate - Content Elements
Ownership100
Maintenance100
Security60
Support70
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • InfoSEC-313 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
gn_themes6 Apr 2011 to 17 Oct 2026, 354 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
17 days ago
Releases, 24 months
31
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter for Shortcodes Ultimate - Content Elements
Q1 20244
Q2 20248
Q3 20242
Q4 20243
Q1 20252
Q2 20254
Q3 20253
Q4 20252
Q1 20263
Q2 202611
Q3 20263
Q4 20261

Last release 17 Oct 2026. Tested with WordPress 7.1 (current).

Support

50% of 2 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Apr 2026Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter6.1<= 7.3.37.3.40
15 Apr 2026WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode6.4<= 7.4.97.5.00
3 Apr 2026Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode6.4<= 7.4.87.4.90
3 Apr 2026Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode6.4<= 7.4.77.4.80
31 Mar 2026WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute6.4<= 7.4.107.5.00
23 Nov 2025WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery6.4<= 7.4.57.4.60
21 Jul 2025Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link6.4<= 7.4.27.4.30
20 Jul 2025WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes6.4<= 7.4.27.4.30
20 Jul 2025Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution6.1<= 7.4.27.4.30
3 Jul 2025Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute6.4<= 7.4.07.4.10
2 Jul 2025Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library6.4<= 7.4.27.4.314
5 Jun 2025Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 7.3.57.4.00
3 Mar 2025WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter6.4<= 7.3.37.3.40
22 Oct 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting5.4<= 7.2.27.3.00
4 Jun 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode6.4<= 7.1.67.1.70
20 May 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode6.4<= 7.1.57.1.60
29 Apr 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 7.1.27.1.30
24 Apr 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox6.4<= 7.1.07.1.20
5 Apr 2024Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 7.0.57.1.00
23 Mar 2024Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode6.4<= 7.0.47.0.50
27 Feb 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode6.4<= 7.0.37.0.40
19 Feb 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode6.4<= 7.0.27.0.30
7 Feb 2024WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode6.4<= 7.0.17.0.20
18 Dec 2023WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4<= 7.0.07.0.10
27 Nov 2023WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure4.3<= 5.13.37.0.00

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Shortcodes Ultimate - Content Elements
Q3 20254.0
Q4 20254.6
Q1 20264.5
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating rose from 4.0 to 5.0 between Q3 2025 and Q4 2026.

Rating distribution
5 star5528
4 star276
3 star43
2 star21
1 star57
Latest low reviews

Momentum

400,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Shortcodes Ultimate - Content Elements
4 May 20265,260
11 May 202610,537
18 May 2026182,464
25 May 202625,971
1 Jun 2026208,115
8 Jun 2026254,476
15 Jun 202624,844
22 Jun 202617,188
29 Jun 202615,531
6 Jul 202623,162
13 Jul 202612,271
20 Jul 2026109,480
27 Jul 202636,814
3 Aug 202634,267
10 Aug 202618,010
17 Aug 202614,320
24 Aug 202613,731
31 Aug 202611,484
7 Sep 202647,229
14 Sep 202697,244
21 Sep 2026121,121
28 Sep 202632,750
5 Oct 202631,534
12 Oct 202672,736
19 Oct 202682,503
26 Oct 202634,607
2 Nov 20262,915

Weekly downloads over the last 4 weeks are 16% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Blocks Animation: CSS Animations for Gutenberg BlocksScore 93 · 90,000+Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & MoreScore 93 · 80,000+Spectra Blocks - AI Website Builder for the Block EditorScore 93 · 60,000+Gmap BlockScore 93 · 10,000+Twentig Supercharged Block Editor - Blocks, Patterns, Starter Sites, PortfolioScore 92 · 20,000+

Facts

Version7.9.2
AuthorVova
Added6 Apr 2011
Last updated17 Oct 2026
Active installs400,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP7.0
CategoryContent Management > Blog & Article Publishing
Tagscarousel, lightbox, shortcode, shortcodes, block-editor

Other plugins by this author: VovaBlocks - Marketing & Content Blocks for Gutenberg, Admin Bar Edit Links for Gravity Forms, Vova's Post Grids, Sunrise, News Bar Plus

Questions

Is Shortcodes Ultimate - Content Elements still maintained?

Shortcodes Ultimate - Content Elements was last updated on 17 Oct 2026. Its Canary status is Healthy.

Is Shortcodes Ultimate - Content Elements safe?

Shortcodes Ultimate - Content Elements has no open unpatched vulnerabilities on record. 13 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Shortcodes Ultimate - Content Elements?

The wordpress.org author is Vova. Recent committers: gn_themes, plugin-master. We have recorded no ownership change.

What can I use instead of Shortcodes Ultimate - Content Elements?

Plugins in the same category with a higher Canary Score: Blocks Animation: CSS Animations for Gutenberg Blocks, Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More, Spectra Blocks - AI Website Builder for the Block Editor, Gmap Block, Twentig Supercharged Block Editor - Blocks, Patterns, Starter Sites, Portfolio.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue