CVE-2021-24693

The Simple Download Monitor plugin before version 3.9.5 fails to properly sanitize the "File Thumbnail" post meta field when displaying it on certain pages, enabling contributors and other low-privileged users to inject malicious scripts that persist in the database. Because this vulnerability is exploitable even when downloads await review, an attacker with contributor access could execute arbitrary JavaScript in an administrator's browser session, potentially allowing them to create unauthorized admin accounts or deploy malicious plugins.

Based on public CVE data (MITRE/NVD).