This vulnerability is a CSRF flaw that also permits reflected XSS. An attacker can craft a malicious link that, when clicked by an authenticated WordPress user, triggers the Bulk Watermark plugin to execute unintended actions or inject script code. The weakness stems from improper verification of request integrity (CWE‑352).

The ChrisHurst Bulk Watermark WordPress plugin, all versions up to and including 1.6.10, is affected. Users running any of these releases are at risk.

The CVSS score of 7.1 indicates a high impact if exploited. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at this time, and the issue is not currently listed in the CISA KEV catalog. However, the attack vector is straightforward: a legitimate user who has logged into the WordPress CMS is tricked into visiting a crafted URL, enabling the attacker to perform unauthorized actions or inject reflected scripts. Based on the description, the plugin may process critical operations via GET requests, potentially amplifying risk, but this is inferred and not explicitly stated.