Still works on 6.8.2

Since the last review from 2018 was/is a really negative one, I decided to add mine also. I’ve been using this plugin for ages now, and it still works.
There are some things that could be improved to make it more safe and more “2025”:

1. Sanitize All Shortcode Attributes: Use sanitize_text_field() for all user-supplied attributes before use, even if you escape them on output.
2. Defensive Defaults: Ensure all attributes have safe defaults and are validated.
3. Escaping: You already use esc_url() and esc_html(), but also use esc_attr() for all HTML attributes.
4. Remove Deprecated PHP: The use of &$this in add_shortcode is not needed in modern PHP.

I don’t know how to suggest codechanges via SVN, but if the code is somewhere in github, I’m happy to provide them. And others: thank you for providing this plugin for free all those many years ago! 🙂