Threat database

The Debloat – Remove Unused CSS, Optimize JS WordPress plugin versions up to 1.3.0 contains a directory traversal vulnerability via the 's' parameter. This flaw allows authenticated users with administrator-level access or higher to read arbitrary files on the server if the Optimize CSS feature with Inline Google Fonts is enabled. The vulnerability can be triggered by an unauthenticated visitor with a crafted GET request to the public search URL. The CVSS score is 5.9, indicating a medium severity issue.