Shortcake (Shortcode UI)

Shortcake makes using WordPress shortcodes a piece of cake.

v0.7.4Daniel BachhuberUpdated 2019-01-16Added Mar 18, 201510k+ installs82% rating
35
Score
9
Errors
39
Warnings
+0
Change

Category Scores

Security24
Repo85
Performance100
Maintainability88

Top Issues by Category

Issues Details

48 issues found in latest scan

WARNING16
WordPress.Security.ValidatedSanitizedInput.MissingUnslash

$_GET['attr'] not unslashed before sanitization. Use wp_unslash() or similar

WARNING7
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

Detected usage of a non-sanitized input variable: $_GET['include']

WARNING6
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "enqueue_shortcode_ui".

ERROR4
missing_direct_file_access_protection

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERROR3
WordPress.Security.EscapeOutput.OutputNotEscaped

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$this'.

WARNING3
WordPress.WP.EnqueuedResourceParameters.NotInFooter

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

WARNING2
Internal.NoCodeFound

No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.

WARNING2
WordPress.Security.NonceVerification.Recommended

Processing form data without nonce verification.

WARNING2
WordPress.Security.ValidatedSanitizedInput.InputNotValidated

Detected usage of a possibly undefined superglobal array index: $_POST['queries']. Check that the array index exists before using it.

WARNING1
WordPress.WP.DeprecatedParameters.Wp_count_termsParam2Found

The parameter "$args" at position #2 of wp_count_terms() has been deprecated since WordPress version 5.6.0. Instead do not pass the parameter.

ERROR1
hidden_files

Hidden files are not permitted.

ERROR1
outdated_tested_upto_header

Tested up to: 5.0 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.

Latest Snapshot

Findings

48

Errors

9

Warnings

39

Score History

First score snapshot

First scan completed Jun 20, 2026

v0.7.4 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2

Jun 20, 2026

v0.7.4

35

Latest

Findings
48
Errors
9
Warnings
39
Plugin Check
2.0.0
Model
2026.06-mvp-static-v2

Related Plugins