Image Watermark
Image Watermark has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Image Watermark has a vendor fix available, so running the current release closes it.
All of these findings were reported by Lucio Sá. Image Watermark is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-1994Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification
Read the full analysisVulnerability Records

Image Watermark
Author
dFactory
Enhance your WordPress site’s image security and branding. Image Watermark allows you to apply image or text overlays to new uploads and bulk process existing Media Library images with ease. Key Features: Watermark Types: Choose from image-based or text-based watermarks with full customization. Flexible Application: Automatic watermarking on uploads, manual/bulk apply/remove via Media Library. Advanced Customization: Position watermarks precisely, adjust sizes, opacity, and more. Small Image Rules: Skip watermarking for images below configurable minimum width and height thresholds. Backup & Restore: Secure backups for easy watermark removal. Image Protection: Prevent copying via right-click, drag-and-drop, and developer tools. Status & Diagnostics: Review PHP, image engine, and backup-folder readiness from the built-in Status tab. Technical Excellence: Supports JPEG, PNG, WebP; ImageMagick/GD engines; preserves metadata. Perfect for photographers, bloggers, and businesses looking to safeguard their visual content. For more information, check out the plugin page, documentation, or support forum. Feature Breakdown: Watermarking Types: * Support for image-based watermarks (upload custom images as watermarks) * Support for text-based watermarks (customizable fonts, colors, and sizes) * Automatic watermarking on new uploads to the Media Library * Manual and bulk watermarking for existing images (apply or remove via Media Library actions) Customization & Settings: * Flexible watermark positioning (9 alignment options with pixel or percentage-based offsets) * Three watermark size modes: original, custom dimensions, or scaled to image size * Adjustable watermark transparency and opacity * Watermark preview support for image and text watermark modes * Optional skip rules for small images based on minimum width and height thresholds * Selective application: Choose specific post types or enable everywhere (including frontend uploads) * Image format selection (baseline or progressive JPEG) * Configurable image quality settings Backup & Management: * Automatic image backup functionality (stores originals for easy restoration) * Option to remove watermarks (restores from backups when available) * Optional preservation of file timestamps during backup and restore * Secure backup storage with .htaccess protection Image Protection: * Disable right-click context menus on images * Prevent image copying via drag-and-drop * Block access to developer tools for image inspection * Customizable protection notice/toast message displayed to users attempting to copy images Technical Information: * Support for JPEG, PNG, and WebP image formats * Dual image processing engines: ImageMagick (preferred) with GD library fallback * EXIF and IPTC metadata preservation (where supported) * Cache-busting for immediate thumbnail updates after watermark changes * Built-in Status tab for PHP, engine, and backup-folder diagnostics * Translation-ready with included .pot file
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C