Issues with WordPress 4.0.1 and Shortcodes

If you’ve upgraded to WordPress 4.0.1 and a feature using shortcodes has broken (like a slider, or a visual composer), the reason is that code wasn’t properly using the WP Shortcode API.

Code that parsed shortcodes themselves, instead of using the normal add_shortcode handlers and such, may be surprised by the new behavior of texturize, because the quote marks in what wp thinks isn’t a shortcode get texturized now like everything else. So their filters, which probably come after texturize, don’t get the expected quote marks.

For users, the best way to fix this is upgrade. Many plugins have already released fixes, more are on the way. While it is possible to downgrade to WP 4.0, we really hope you don’t because of how serious the security fixes were. If you absolutely MUST downgrade, please nag your plugin/theme devs a lot to fix this STAT. Or stop using their stuff. It’s that big.

For developers, if you’re making shortcodes, use the Shortcode API instead of rolling your own. Using the proper add_shortcode() function to add shortcodes, instead of simply filtering the content, will prevent this problem. If you absolutely must implement your shortcodes with filters instead of using the API correctly, then you can use the no_texturize_shortcodes filter to prevent this from running on your self-implemented shortcodes.

You can read about the details on trac: https://core.trac.www.ads-software.com/ticket/29557