Opera before 9.26 allows remote attackers to \bypass sanitization filters\ and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document which are not properly handled during DOM presentation.