CVE-2025-23425: 
WordPress vulnerability analysis and mitigation

The Marekkis Watermark WordPress plugin versions up to and including 0.9.4 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by SOPROBRO and publicly disclosed on February 16, 2025. This security issue has been assigned CVE-2025-23425 with a CVSS score of 6.1 (Medium) (Wordfence, Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation, specifically a Reflected Cross-Site Scripting (XSS) issue. The CVSS score varies between sources, with ratings of 6.1 to 7.1, indicating a medium severity level. The vulnerability can be exploited without authentication, making it particularly concerning (Patchstack).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the affected website. These injected scripts would be executed when visitors access the site (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires no authentication to exploit, making it accessible to unauthenticated attackers (Patchstack).

Currently, there is no official fix available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement the mitigation immediately (Patchstack).