The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the \File Thumbnail\ post meta before outputting it in some pages which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account or install a malicious plugin