WP Manifestindependent plugin directory
manifest / content / azrcrv-shortcodes-in-comments

Shortcodes in Comments WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Shortcodes in Comments plugin for ClassicPress

★ 1stars
1.5krelease downloads
≈160active sites
v2.0.0latest · 1mo ago

Install

Download azrcrv-shortcodes-in-comments.zip From the v2.0.0 release on GitHub, Sep 9, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/azurecurve/azrcrv-shortcodes-in-comments/releases/download/v2.0.0/azrcrv-shortcodes-in-comments.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Shortcodes in Comments

Plugin Banner

Allows an admin-defined list of shortcodes to be expanded in comments.

Description

Allows an admin-defined list of shortcodes to be expanded in comments.

Installation

  • Download the latest release of the plugin from GitHub.
  • Upload the entire zip file using the Plugins upload function in your ClassicPress admin panel.
  • Activate the plugin.
  • Configure the allowed shortcodes via the configuration page in the admin control panel (azurecurve menu); shortcodes from BBCode are allowed by default.

Frequently Asked Questions

Can I translate this plugin?

Yes, the .pot file is in the plugin's languages folder; if you do translate this plugin, please send the .po and .mo files to translations@azurecurve.co.uk for inclusion in the next version (full credit will be given).

Is this plugin compatible with both WordPress and ClassicPress?

This plugin is developed for ClassicPress, but will likely work on WordPress.

Changelog

Version 2.0.0

  • Rebuilt to match the current azurecurve plugin architecture (namespaced code, settings/menu split across includes files, tabbed admin UI matching Shortcodes in Widgets).
  • Fixed a bug where the plugin misused the comments_template filter as if it were an action, risking the comments template failing to load on some sites; shortcode restriction is now applied entirely within the comment_text filter itself.
  • Fixed a bug where the allow-list restriction could remain in effect for the rest of the page after a comment was rendered, on any theme/template that doesn't fire dynamic_sidebar().
  • Fixed allowed-shortcodes entries with surrounding whitespace (e.g. "b, i, u") not matching correctly, and entries on separate lines not being treated as separators.
  • Fixed a PHP warning on a never-configured settings page (defaults weren't actually applied on read).
  • Removed the multisite network-wide settings feature (Network Admin > Settings > Shortcodes in Comments and the per-site "Use Network Settings" option) - it was never really supported by ClassicPress and, on top of that, was found to be non-functional in the pre-2.0.0 plugin (the save form posted to the wrong endpoint for the action hook that was registered, so saving network settings silently did nothing). Each site now always uses its own Settings tab.
  • Fixed an inefficient plugin_action_links hook so it no longer runs for every plugin on the Plugins list page.
  • Replaced the hard-coded "Shortcodes in Widgets" link with a standard, auto-generated Other Plugins tab.
  • Added an Instructions tab.
  • Added a proper uninstall.php cleanup, consistent with the rest of the azurecurve plugin family.
  • BREAKING: minimum PHP requirement raised to 8.2.
  • BREAKING: text domain renamed from shortcodes-in-comments to azrcrv-sic; existing translation (.po/.mo) files must be re-supplied under the new domain.
  • Update readme.md and remove readme.txt (not required for ClassicPress).
  • Update azurecurve menu.

Version 1.2.6

  • Update plugin header and readme yet again for compatibility with ClassicPress Directory v2.
  • Fix bug with unset options.

Version 1.2.5

  • Update plugin header and readme for compatibility with ClassicPress Directory v2.
  • Update Update Manager to version 2.5.0.

Version 1.2.4

  • Update readme file for compatibility with ClassicPress Directory.

Version 1.2.3

  • Update readme files.
  • Update language template.
  • Fix bug with azurecurve menu.

Version 1.2.2

  • Update azurecurve menu.
  • Update readme files.

Version 1.2.1

  • Update azurecurve menu and logo.

Version 1.2.0

  • Fix plugin action link to use admin_url() function.
  • Rewrite option handling so defaults not stored in database on plugin initialisation.
  • Add plugin icon and banner.
  • Update azurecurve plugin menu.

Version 1.1.4

  • Fix bug with setting of default options.
  • Fix bug with plugin menu.
  • Update plugin menu css.

Version 1.1.3

  • Rewrite default option creation function to resolve several bugs.
  • Fix bug in remove shortcodes function.
  • Upgrade azurecurve plugin to store available plugins in options.

Version 1.1.2

  • Update Update Manager class to v2.0.0.
  • Update action link.
  • Update azurecurve menu icon with compressed image.
  • Fix wrong link to Shortcodes in Widgets

Version 1.1.1

  • Fix bug with incorrect language load text domain.

Version 1.1.0

  • Add integration with Update Manager for automatic updates.
  • Fix issue with display of azurecurve menu.
  • Change settings page heading.
  • Add load_plugin_textdomain to handle translations.

Version 1.0.1

  • Update azurecurve menu for easier maintenance.
  • Move require of azurecurve menu below security check.
  • Localization fixes.

Version 1.0.0

  • Initial release for ClassicPress forked from azurecurve Shortcodes in Comments WordPress Plugin.

Other Notes

About azurecurve

azurecurve was one of the first plugin developers to start developing for ClassicPress; all plugins are available from azurecurve Development and are integrated with the Update Manager plugin for fully integrated, no hassle, updates.

The plugins available from azurecurve are:

Releases

15 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.0 latest
Sep 9, 2026 1mo ago
azrcrv-shortcodes-in-comments.zip
60
Apr 13, 2025 1 year ago
azrcrv-shortcodes-in-comments.zip
155
Feb 3, 2024 2 years ago
azrcrv-shortcodes-in-comments.zip
928
Feb 4, 2023 3 years ago
azrcrv-shortcodes-in-comments.zip
159
Apr 3, 2022 4 years ago
azrcrv-shortcodes-in-comments.zip
75
Dec 10, 2021 4 years ago
azrcrv-shortcodes-in-comments.zip
40
May 15, 2021 5 years ago
azrcrv-shortcodes-in-comments.zip
49
Oct 29, 2020 5 years ago
azrcrv-shortcodes-in-comments.zip
14
Apr 5, 2020 6 years ago
azrcrv-shortcodes-in-comments.zip
8
Apr 4, 2020 6 years ago
azrcrv-shortcodes-in-comments.zip
7
Mar 29, 2020 6 years ago
azrcrv-shortcodes-in-comments.zip
7
Feb 3, 2020 6 years ago
azrcrv-shortcodes-in-comments.zip
6
Jan 28, 2020 6 years ago
azrcrv-shortcodes-in-comments.zip
5
Jan 7, 2020 6 years ago
azrcrv-shortcodes-in-comments.zip
6
Mar 31, 2019 7 years ago
azrcrv-shortcodes-in-comments.zip
4

Active-site estimate ≈160 comes from the median of recent superseded releases. Method.

A- grade

Security

Shortcodes in Comments 2.0.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
2.0.0
Findings
1
Worst severity
low
Content hash
00a2b840614e3a1661ca6372…

Findings

  • low Default allow-list permits all registered shortcodes in comments

    When the admin leaves the allowed-shortcodes setting blank, the plugin allows every registered shortcode to execute inside comment_text. A commenter (potentially low-trust/unauthenticated depending on comment settings) could invoke any registered shortcode on display; impact depends on which shortcodes are installed and whether comments are moderated.

    includes/functions-shortcodes.php:50-60

    Recommendation

    Default to an empty allow-list meaning no shortcodes, and require the admin to explicitly opt specific shortcodes in.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.