Opera before 12.01 on Windows and UNIX and before 11.66 and 12.x before 12.01 on Mac OS X does not properly escape characters in DOM elements which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML document.