content: VBA != VBScript. VBA is what you use in Excel programming. VBScript is a subset of VBA which was used to offer a Batch scripting replacement and was replaced by Powershell. They both suck but VBScript was certainly the worse of the two. Adding JS appears to me as just a way to attract hipster "data scientists" to Excel. I'm not surprised it took less than a day for someone to find a malicious exploit.