CVE-2009-3265: Opera Browser

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design feature," not a vulnerability.

Affected products

• Opera Opera Browser: version 9.0 only; version 10.00 only

Published 2009-09-18. Last modified 2026-06-16.