Debloat – Remove Unused CSS, Optimize JS

Debloat – Remove Unused CSS, Optimize JS has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 5.9 out of 10.

The most common weakness is Path Traversal, behind 1 of the records (100%).

The one issue recorded for Debloat – Remove Unused CSS, Optimize JS has a vendor fix available, so running the current release closes it.

All of these findings were reported by Kuba. Debloat – Remove Unused CSS, Optimize JS is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Debloat – Remove Unused CSS, Optimize JS vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.9CVE-2026-104769

Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

Read the full analysis

Vulnerability Records

1 records


2026-10-15 15:25	Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link> Debloat <= 1.3.0	`CVE-2026-104769`	5.9 Medium	Kuba	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv1.4.0

Debloat – Remove Unused CSS, Optimize JS

Author

asadkn

4.8(41)

96/100

Last Updated

2026-10-09 (11d ago)

Active Installs

30,000+

Downloads

424,209

Requires WP

5.0+

Requires PHP

7.4.1+

Tested up to

WP 7.1.3

Created

2021-08-21 (5y ago)

A plugin for Advanced Users to Optimize CSS Delivery, Remove Unused CSS, Optimize Javascript Delivery with defer or delay load JS. The perfect toolkit for improving your Core Web Vitals and overall website performance. WARNING: It’s a powerful speed optimization plugin that’s meant for power users who know what they’re doing. Features: Optimize CSS: Fix Render-Blocking. Minify and Inline CSS. Remove Unused CSS (Advanced). Optimize JS: Fix Render-Blocking with defer. Delay Load some JS until user interaction. Adds resource hints for faster Google Fonts. Built-in optimizations for Elementor (free version). Built-in optimizations for WPBakery Page Builder. Compatible with all themes and plugins. Supports all modern browsers (no IE11 support). Optimized code benchmarked for performance. Built-in cache for processing. Compatible with cache plugins (disable their JS and CSS optimizations). API and hooks for theme & plugin authors.

View on WordPress.org