This is probably a silly question. Could someone potentially use a short code injection attack?

What is stopping someone from injecting something like this?

[shortcode]Do something[/shortcode]

I am sure that WP already thought about this but I am just wondering, what security mechanism stops this type of injection attack?

  • As long as you're not calling do_shortcode on the output, for example, if it is a guest-submitted post content, the shortcode will be parsed because the_content filter has do_shortcode hooked. Also it has to do with the callback that generates your shortcode (e.g checking for current user roles, etc)
    – Ismail
    Feb 4, 2017 at 11:58
  • There was a discussion back in 2015 when a major update was released. It's a long discussion but, oddly enough, nobody seems to mention any security risk ny name or description. [link] make.wordpress.org/core/2015/07/23/changes-to-the-shortcode-api
    – Gonzoarte
    Feb 4, 2017 at 12:35

3 Answers 3

  1. In general, like with any other theme or plugin on your system, there is nothing built-in that can prevent all attack vectors

  2. Shortcodes are a kind of macros for generating HTML. Shortcodes that don't do more than that should generally be safe.

  3. The biggest problem with shortcodes is that their insertion and "execution" do not depend on any capability check. If you have an exploitable shortcode, even a contributor will be able to abuse it.

So what to do? Especially if you are running a multi author site, avoid shortcodes that violate point 2, especially those that explicitly let you execute PHP code, and as always use themes and plugins only from respectable sources (unfortunately, popularity has almost nothing to do with being "respected").


Like with everything the problem is in the PHP code. As Mark explained, always use themes and plugins from respectable sources. There is one tool called RIPS that you may also use.


It is possible for an individual with a Contributor role to perform stored XSS via shortcode attributes. Which is why it is important to validate attributes and escape any output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.