The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) \color\ or \css_class\ argument of sdm_download shortcode 2) \class\ or \placeholder\ argument of sdm_search_form shortcode.