Input validation vulnerability in Simple Download Counter 1.6

The Simple Download Counter plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack is possible in versions of the plugin up to and including version 1.6. The attack is made possible because the plugin doesn’t properly check user supplied information (such as ‘before’ and ‘after’ attributes) and doesn’t escape dangerous characters. An attacker with Contributor-level permissions or higher on the WordPress site can inject malicious web scripts into pages which will be run whenever a user accesses the page.