Apache Roller version 6.1.5 contains an improper neutralization of input that allows an anonymous remote attacker to store a crafted comment author URL. When a moderator or global administrator later visits the comment management page, the stored URL is rendered without sanitization, allowing the stored script to execute in the victim’s browser during that session. This flaw provides a stored cross‑site scripting vector that can run arbitrary client‑side code in the context of privileged users.

The vulnerability affects all installations of Apache Roller version 6.1.5 and earlier that permit comments on at least one weblog. No special server configuration is required; the flaw exists in the default distribution. Users should be aware that any site running Roller 6.1.5 or older and accepting public comments is susceptible.

The CVSS score of 6.1 indicates moderate severity. EPSS is not available, so the current exploitation likelihood cannot be quantified, but the vulnerability does not require authentication and can be triggered by any anonymous visitor who submits a comment. The flaw is not listed in the CISA KEV catalog. The likely attack vector would involve an unauthenticated user posting a malicious comment and a moderator subsequently reviewing it, which is a common workflow on public blogs.