CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769 Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

EUVD-2026-102616

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769 Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.3.0 . The flaw exists in the 's' parameter and allows an unauthenticated visitor to read arbitrary files on the server, potentially exposing sensitive infor...

PT-2026-115402

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769: Improper Limitation of a Pathname to a Restricted Directory

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

WordPress Debloat – Remove Unused CSS, Optimize JS plugin <= 1.3.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Kuba in WordPress Plugin Debloat – Remove Unused CSS, Optimize JS versions = 1.3.0...

WordPress Debloat – Remove unused CSS, optimize JS path traversal vulnerabilities

WordPress Debloat – Remove unused CSS and optimize JS versions 1.3.0 and earlier. Version 1.3.0 and earlier have a path traversal vulnerability due to improper handling of the parameter “s”. This vulnerability allows for directory traversal attacks, potentially enabling authenticated attackers wi...

debloat

Debloat Debloat is a GUI and CLI tool to remove excess garbage from bloated executables. By excess garbage, I mean 100 - 800 MB of junk bytes added to a binary to keep it from going into a sandbox. This method of adding junk is called "inflating" or "pumping" a binary. Debloat currently handles t...