Apache Roller allows an unauthenticated remote attacker to store a malicious URL in the "author" field of a comment through the incoming Trackback endpoint when the entry accepts comments and Trackbacks. The value is approved and rendered as an active link, enabling script execution in the context of the weblog. This stored XSS flaw permits client‑side attack code that can be used for session hijacking, defacement, or further cookie theft.

The vulnerability exists in Apache Roller 6.1.5 and earlier versions. The affected vendor is the Apache Software Foundation, product Apache Roller. Users running these versions are exposed if their blog accepts Trackbacks and comments.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score is not available, making precise likelihood assessment uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker requires only to submit a Trackback comment with a crafted URL, which a site moderator may approve by default. Once approved, any visitor clicking the link runs the embedded script in the weblog's origin, enabling client-side code execution without further credentials.