WP-ShowHide

Explore WP-ShowHide vulnerabilities across all versions. Currently tracking 2 known vulnerabilities, including severity, impact, and patch status.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all WP-ShowHide vulnerabilities before they are exploited.

Vulnerability Records

2 records
WP-ShowHide banner
Latestv2.0.0
4.2(43)
84/100
Last Updated
2026-07-25 (4d ago)
Active Installs
9,000+
Downloads
147,100
Requires WP
4.6+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2011-04-28 (16y ago)

By default the content is hidden and user will have to click on the “Show Content” link to toggle it. Similar to what Engadget is doing for their press releases. Example usage: [showhide type="pressrelease"]Press Release goes in here.[/showhide] Usage By default, content within the showhide shortcode will be hidden. Example: [showhide]Press release content goes in here.[/showhide] Default Values: [showhide type="pressrelease" more_text="Show Press Release (%s More Words)" less_text="Hide Press Release (%s Less Words)" hidden="yes"] You can have multiple showhide content within a post or a page, just by having a new type. Example: [showhide type="links" more_text="Show Links (%s More Words)" less_text="Hide Links (%s Less Words)"]Links will go in here.[/showhide] If you want to set the default visibility to display. Example: [showhide hidden="no"]Press release content goes in here.[/showhide] You can style the content via CSS that is generated by the plugin. Here is a sample of the generated HTML. Note that pressrelease is the default type. <div id="pressrelease-link-1" class="sh-link pressrelease-link sh-hide"> <button type="button" class="sh-toggle" aria-expanded="false" aria-controls="pressrelease-content-1" data-sh-more="Show Press Release (4 More Words)" data-sh-less="Hide Press Release (4 Less Words)">Show Press Release (4 More Words)</button> </div> <div id="pressrelease-content-1" class="sh-content pressrelease-content sh-hide" hidden>Content</div> With the example above, here are the following styles you can use in your CSS: .sh-link { } .sh-toggle { } .sh-content { } .pressrelease-link { } .pressrelease-link.sh-hide .sh-toggle { } .pressrelease-link.sh-show .sh-toggle { } .pressrelease-content { } .pressrelease-content.sh-hide { } .pressrelease-content.sh-show { } Development https://github.com/lesterchan/wp-showhide Credits Plugin icon by Freepik from Flaticon Donations I spent most of my free time creating, updating, maintaining and supporting these plugins, if you really love my plugins and could spare me a couple of bucks, I will really appreciate it. If not feel free to use it without any obligations. Breaking Changes Version 2.0.0 rewrites the front-end JavaScript. The shortcode and its attributes are unchanged, so your posts do not need editing — but the generated HTML is different, so custom CSS and JavaScript may need updating. The toggle is now a <button class="sh-toggle"> instead of <a href="#">. CSS targeting .sh-link A must become .sh-link .sh-toggle. The plugin ships a small inline style so the button still renders as a plain text link rather than a native button. The inner <span id="{type}-toggle-{post_id}"> has been removed. The label now sits directly on the button, so anything targeting that ID should target .sh-toggle instead. Hidden content now uses the hidden attribute instead of style="display: none;". If your CSS sets display on .sh-content it will now win over [hidden]; add .sh-content[hidden] { display: none; } or raise your specificity. jQuery is no longer enqueued by this plugin. If your theme was relying on WP-ShowHide to pull jQuery onto the page, enqueue it yourself. The global showhide_toggle() function has been removed. Nothing replaces it. To toggle a block programmatically, click its .sh-toggle button; to react to a toggle, listen for the sh-link:toggle event. Internet Explorer is no longer supported. The script uses Element.closest() and the CustomEvent constructor. Repeating the same type within one post now appends a counter to the element IDs (pressrelease-content-1, pressrelease-content-1-2, …). The first occurrence keeps its original ID, so this only affects posts that were previously emitting duplicate IDs anyway. Style by class rather than ID if you use this pattern. The sh-link:more, sh-link:less and sh-link:toggle events are not a breaking change — they still fire on the .sh-link element and still bubble, so existing jQuery( ... ).on( 'sh-link:toggle', ... ) handlers keep working.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C