CVE-2025-32520

Summary

CVE-2025-32520 is a Cross-site Scripting (XSS) vulnerability affecting the WordPress Health and Server Condition plugin, which is integrated with Google Page Speed. The flaw is caused by improper neutralization of user input during web page generation. An attacker can exploit this vulnerability by injecting malicious scripts into the plugin, allowing Reflected XSS attacks. Successful exploitation could lead to unauthorized access to user data or session hijacking. WordPress Health and Server Condition plugin versions from n/a through 4.1.1 are at risk. To mitigate this vulnerability, users should upgrade to the latest version of the plugin or remove it if it's no longer needed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.