Persistant XSS

Hmm not sure if the report is valid.

1. Only admins can add a download and the field is open ended because there might be somecases where user need to have JS tracking
2. If going by this logic, XSS also is valid in WordPress post because if if I am an admin, I can post JS within a post content.

But anyway, I added wp_kses_post() to better sanatize the fields https://github.com/lesterchan/wp-downloadmanager/commit/302557a3a2819f8a5f4deb22f02e7aa00116d6d4. It will be released in the next version