PHPPresentation 1.2.0 contains a cross‑site scripting flaw in the HTML writer. Attackers can craft a PPTX file that embeds malicious scripts in text runs, hyperlink relationship targets, or shape description attributes, which the library emits unescaped into the generated HTML. The result is JavaScript code that runs in any user’s browser when the HTML is viewed, potentially allowing session hijacking, data theft, or further compromise. This is a classic input validation weakness identified as CWE‑79.

The affected product is PHPOffice’s PHPPresentation, version 1.2.0. Any system that incorporates this library and uses the HTML writer to transform PPTX files into web‑viewable HTML is vulnerable. No later releases are documented as fixed, so environments that still use 1.2.0 carry the risk.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, so there is no known widespread exploitation. Nonetheless, the vulnerability is exploitable when an attacker supplies a malicious PPTX and users view the resulting HTML. The risk is higher in contexts where the library processes untrusted user uploads or automatically exposes generated HTML.