Following is the reformatted version of your code. get_delete_post_link()
is used for fetching delete post URL so that we dont have to worry about nonce stuff. global $post
is kept to avoid PHP notice which is currently there in your code. Please check it.
function wpso_delete_my_posts() {
global $post;
ob_start();
if ( current_user_can('delete_posts', $post->ID ) ) {
echo '<a class="delete-post" rel="nofollow" href="' . esc_url( get_delete_post_link( $post->ID ) ) . '">Delete Post</a>';
}
return ob_get_clean();
}
add_shortcode( 'delete_me', 'wpso_delete_my_posts' );