An improper neutralization of input during web page generation allows a reflected cross‑site scripting (XSS) exploit in the Marekkis Watermark plugin. Based on the description, it is inferred that an attacker can supply a malicious URL that contains crafted input to be reflected in the page, enabling the injection of JavaScript into the output. This may lead to session hijacking, defacement, or the delivery of additional malware. This vulnerability is mapped to CWE‑79.

The vulnerability affects the Marekkis Watermark WordPress plugin version 0.9.4 and any earlier releases. It can occur on any WordPress installation that hosts the plugin, regardless of the site’s theme or other plugins.

The CVSS base score is 7.1, indicating high severity. The EPSS score of less than 1% shows a very low likelihood of exploitation at present, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a victim visiting a specially crafted URL that the attacker controls, which is typical of reflected XSS in publicly accessible web applications. Although the low EPSS suggests limited active exploitation, the high severity warrants patching or mitigation.