Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking

Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nabil Irawan. Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2025-57985

Ultimate Watermark <= 1.1 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking banner
Latestv2.2.0

Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking

MantraBrain

Author

MantraBrain

3.3(11)
66/100
Last Updated
2026-10-18 (10d ago)
Active Installs
1,000+
Downloads
32,144
Requires WP
5.9+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2019-02-20 (8y ago)

Ultimate Watermark adds a copyright text or logo watermark to your WordPress images: automatically on upload, in bulk for the images you already have, or one image at a time. Every original is backed up first, so you can restore any image in one click. It is built for photographers, bloggers, WooCommerce stores and multi-vendor marketplaces (Dokan) that need real image protection without external services: everything runs on your own server with the same Imagick / GD libraries WordPress already uses. 🔗 Plugin page 🚀 Try it free 📚 Documentation 💎 Ultimate Watermark Pro Free features Text and image watermarks Text watermark: your copyright line, brand name or URL, with font family, size (up to 200 px), colour, bold, italic, light weight, and underline, overline or line-through. Image watermark: any logo or signature from your Media Library (transparent PNG recommended; JPG, WebP and GIF also work). Logo size: original, custom width/height, or scaled as a percentage of each photo, so the logo stays proportional on small and large images. 9-point position grid, X/Y offsets in pixels or percent (negative values allowed), rotation and opacity. Repeat pattern: tile the watermark across the whole image with adjustable spacing. Covers landscape, portrait and square photos completely, including rotated text, for a classic stock-photo look. Output quality per watermark (JPEG quality, baseline or progressive). Live preview with a real photo while you edit, showing which image library (Imagick or GD) is in use. Four ways to apply Automatic: new uploads are watermarked as they arrive. A toggle in the upload screen and media modals lets you switch it off for a single upload, and choose which watermark(s) to use. Bulk: select any number of images in the Media Library, in list view (Bulk actions) or grid view (Bulk select), and apply or remove a watermark. Manual: apply or remove a watermark from a single image: from the attachment details popup or the edit-media screen. Frontend uploads: images uploaded from the front end of your site, such as a Dokan vendor dashboard or a front-end form, are watermarked too. Rules Limit a watermark to the images it belongs on, by image size (thumbnail, medium, large, full and every theme / WooCommerce size) and post type (posts, pages, products, custom post types). Combine conditions with AND / OR. Without rules a watermark applies everywhere. Pro adds 11 more conditions (see below). WooCommerce and Dokan Product images, gallery images and variation images are watermarked automatically, including products created from the Dokan vendor dashboard, the block editor, the REST API or imports. Rules are evaluated after the product and its categories are saved, so product-based rules work on the very first publish. Downloadable files are never touched: files uploaded as downloadable products (stored in woocommerce_uploads) or attached to a product’s downloads are never watermarked, resized, copied or previewed, so buyers always receive the exact original. Vendors can only watermark, remove or restore their own images. Backup and restore The original is backed up before the first watermark is applied: full size only, or full size plus every watermarked size. Restore one image or many from Watermark → Backups, or remove the watermark from the Media Library. Thumbnails are regenerated automatically. Backups are stored in a protected folder with unguessable names and are only viewable by administrators. Failure-safe: images, backups and restores are written to a temporary file and swapped in only when complete. With backups on, an image is never changed if its original could not be saved first. Image protection Disable right-click and drag-and-drop on images, optionally also for logged-in users. Dashboard and analytics Dashboard with total and protected images, protection rate, active watermarks and recent activity. Analytics with watermark usage over time and protection trends. Built for real sites Imagick (preferred) with automatic GD fallback, including per-image fallback when Imagick lacks a format. JPEG, PNG (transparency kept), WebP, AVIF (with Imagick) and GIF. Animated GIFs are skipped so they keep their animation. Large uploads (WordPress’ “-scaled” images), cropped copies and sizes that share one file are each watermarked exactly once. Re-applying never stacks a watermark twice. Works with every page builder (Gutenberg, Elementor, Divi, Beaver Builder, Bricks): watermarks are part of the image file itself. Tested on PHP 7.4 to 8.4 with both GD and Imagick, on WordPress 7.1 with WooCommerce and Dokan. Requires WordPress 5.9 or later. Translation-ready, with developer filters and actions throughout. 1.x settings and watermarks are migrated automatically. Pro features Ultimate Watermark Pro is an add-on for this plugin. It adds: Unlimited watermarks: the free version has one watermark; Pro removes the limit, so you can use different watermarks per size, post type or product category. 11 extra rule conditions: file type, file size, image width, image height, orientation (landscape / portrait / square), aspect ratio, upload date, user role, post category, and WooCommerce product category and product tag. 45+ dynamic placeholders in text watermarks: site name and URL, dates and times, copyright year and holder, uploader name and role, image title, caption, alt text and filename, post title, post category, custom fields and more. EXIF placeholders: camera make and model, lens, focal length, aperture, shutter speed, ISO, flash, exposure mode and white balance, for photo credits such as {{camera_model}} · {{aperture}} · ISO {{iso}}. 30 Google Fonts (Roboto, Open Sans, Montserrat, Playfair Display, Pacifico, Bebas Neue and more) in a searchable picker that previews each font, downloaded once and cached locally. WooCommerce per-product and per-category watermarks: choose a watermark on a single product or a product category, with a Product → Category → Global cascade, plus a “Watermark All Products” bulk action. On-the-fly display watermarks: visitors see watermarked copies of your images in post content, thumbnails and WooCommerce galleries while the files on disk stay untouched. Selected roles see the originals; generated copies are cached. Batch processing: apply, replace or remove watermarks on thousands of images in tracked batches, filtered by upload date, file size, image width and the post type they are attached to, with progress, cancel and resume. Batches continue in the background via WP-Cron. Automatic updates and priority support with your license. Use cases Photographers: protect portfolio shots, watermark a whole season at once, add camera details as a credit (Pro). Bloggers and publishers: brand every featured image with your site name or logo so copies always point back to you. WooCommerce stores: watermark every product photo automatically and launch with the whole catalogue protected. Marketplaces (Dokan): watermark vendors’ product previews while the paid downloadable files stay pristine. Stock and digital media sellers: a tiled watermark across the preview, the clean original only for buyers. Privacy Ultimate Watermark runs entirely on your server. No images, metadata or usage data are sent to MantraBrain or any third party. (Pro contacts the MantraBrain license server only to validate your key and check for updates, and downloads Google Fonts once when you choose one.)

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C