The SliceWP Affiliates plugin for WordPress, versions up to and including 1.2.7, is vulnerable to stored cross-site scripting (XSS) via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts through the 'slicewp_affiliate_url' shortcode due to insufficient input sanitization and output escaping. These scripts execute whenever a user views the affected page.