Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed related to the rendering of the application/rss+xml content type as \scripted content.\ NOTE: the vendor reportedly considers this behavior a \design feature \ not a vulnerability.