Allowing Custom Shortcodes in Eventer using eventer_safe_do_shortcode()

🔒 Why This Function Exists

To ensure maximum security and control, the Eventer plugin uses a custom function eventer_safe_do_shortcode() when rendering user-submitted or dynamic content (such as from organizers, attendees, or imported data).

This function restricts which shortcodes can be processed, preventing unknown or malicious shortcodes from being executed. By default, only shortcodes that begin with eventer_ are allowed.

✅ Always Allowed Shortcodes (Safe List)

The function also allows shortcodes from trusted form plugins by default, such as:

• Contact Form 7

• Gravity Forms

• WPForms

• Ninja Forms

• Formidable Forms

These are always allowed without needing any extra configuration.

➕ How to Allow Additional Shortcodes

If you’re a developer or theme author and want to allow additional shortcodes (e.g. your own custom forms or embeds), you can use the built-in filter:

add_filter( 'eventer_safe_shortcodes_allowlist', function( $allowed ) {
    $allowed[] = 'your_custom_shortcode';
    return $allowed;
});

Example:

add_filter( 'eventer_safe_shortcodes_allowlist', function( $allowed ) {
    $allowed[] = 'my_form_shortcode'; // Allows [my_form_shortcode]
    return $allowed;
});

Place this code in your theme’s functions.php or a custom plugin.

⚙️ How It Works Internally

The function:

• Sanitizes the content with wp_kses_post()

• Temporarily overrides the global list of registered shortcodes

• Executes only the ones in the whitelist

• Restores the original state after execution

This ensures that only safe and intentional shortcodes are ever rendered.