Image Watermark

Image Watermark has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Image Watermark has a vendor fix available, so running the current release closes it.

All of these findings were reported by Lucio Sá. Image Watermark is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Image Watermark vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2024-1994

Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification

Read the full analysis

Vulnerability Records

1 records
Image Watermark banner
Latestv2.0.12

Image Watermark

dFactory

Author

dFactory

4.2(288)
84/100
Last Updated
2026-07-11 (2mo ago)
Active Installs
40,000+
Downloads
1,200,892
Requires WP
6.0+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2013-04-06 (14y ago)

Enhance your WordPress site’s image security and branding. Image Watermark allows you to apply image or text overlays to new uploads and bulk process existing Media Library images with ease. Key Features: Watermark Types: Choose from image-based or text-based watermarks with full customization. Flexible Application: Automatic watermarking on uploads, manual/bulk apply/remove via Media Library. Advanced Customization: Position watermarks precisely, adjust sizes, opacity, and more. Small Image Rules: Skip watermarking for images below configurable minimum width and height thresholds. Backup & Restore: Secure backups for easy watermark removal. Image Protection: Prevent copying via right-click, drag-and-drop, and developer tools. Status & Diagnostics: Review PHP, image engine, and backup-folder readiness from the built-in Status tab. Technical Excellence: Supports JPEG, PNG, WebP; ImageMagick/GD engines; preserves metadata. Perfect for photographers, bloggers, and businesses looking to safeguard their visual content. For more information, check out the plugin page, documentation, or support forum. Feature Breakdown: Watermarking Types: * Support for image-based watermarks (upload custom images as watermarks) * Support for text-based watermarks (customizable fonts, colors, and sizes) * Automatic watermarking on new uploads to the Media Library * Manual and bulk watermarking for existing images (apply or remove via Media Library actions) Customization & Settings: * Flexible watermark positioning (9 alignment options with pixel or percentage-based offsets) * Three watermark size modes: original, custom dimensions, or scaled to image size * Adjustable watermark transparency and opacity * Watermark preview support for image and text watermark modes * Optional skip rules for small images based on minimum width and height thresholds * Selective application: Choose specific post types or enable everywhere (including frontend uploads) * Image format selection (baseline or progressive JPEG) * Configurable image quality settings Backup & Management: * Automatic image backup functionality (stores originals for easy restoration) * Option to remove watermarks (restores from backups when available) * Optional preservation of file timestamps during backup and restore * Secure backup storage with .htaccess protection Image Protection: * Disable right-click context menus on images * Prevent image copying via drag-and-drop * Block access to developer tools for image inspection * Customizable protection notice/toast message displayed to users attempting to copy images Technical Information: * Support for JPEG, PNG, and WebP image formats * Dual image processing engines: ImageMagick (preferred) with GD library fallback * EXIF and IPTC metadata preservation (where supported) * Cache-busting for immediate thumbnail updates after watermark changes * Built-in Status tab for PHP, engine, and backup-folder diagnostics * Translation-ready with included .pot file

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C