Apache Roller 6.1.5 contains a stored cross-site scripting vulnerability (CWE-79) where user-supplied content with authoring rights is improperly neutralized during web page generation. The crafted content is embedded into JavaScript string literals and markup sinks without proper encoding, leading to script execution in other authors' or administrators' browsers. No special configuration is required for exploitation, and the flaw affects weblogs with multiple authors or administrators who do not fully trust each other. The vendor fixed the issue in version 6.1.6 by changing the rendering approach to output these values as text rather than embedding them in JavaScript literals.

An attacker with authoring rights can inject malicious scripts that execute in the browsers of other authors or administrators, potentially leading to session hijacking, unauthorized actions, or data exposure within the affected weblog environment. The vulnerability requires user interaction (UI:R) and privileges to author content (PR:L). The confidentiality and integrity impacts are limited to the affected users' sessions and data, with no direct availability impact.

Users are advised to upgrade to Apache Roller version 6.1.6 or later, where the vulnerability is fixed by changing how user-supplied values are rendered in the UI. No other mitigation is indicated or required by the vendor advisory.