Good morning. Four stories from the weekend that matter if you run a small business website, from urgent WordPress plugin updates to Google putting more ads and AI agents in front of your customers.
1. Several critical WordPress plugin flaws need updating now
Security databases published a cluster of critical (CVSS 9.8) WordPress plugin vulnerabilities between October 30 and November 2. They include an unauthenticated remote code execution bug in WP Project Manager (versions up to 4.1.1, fixed in 4.1.2), a checkout-triggered object injection in PDF Invoice for WooCommerce (up to 7.1.1, fixed in 7.2.0), an unauthenticated object injection in Gravity Forms (up to 3.1.2) and an unauthenticated code execution flaw in s2Member. Patchstack warns that bugs of this kind are typically used in mass-exploit campaigns.
What this means for your business: If your site uses any of these plugins, update today, or deactivate the plugin until you can. Gravity Forms in particular powers contact and quote forms on a huge number of small business sites.
Sources: Patchstack vulnerability statistics, Wordfence vulnerability database, RescuePHP
2. Google will support one robots.txt switch to opt out of AI training
On October 30, Google said it will back a shared “policy token” for robots.txt, based on IETF work, that lets a site state its AI training preference across all participating AI providers in one line instead of listing each company. Bing, OpenAI and Anthropic have announced similar support. Google plans to support it in 2027, and its existing Google-Extended control keeps working alongside it.
What this means for your business: Nothing changes yet, but it will soon be much simpler to decide whether AI companies can train on your content. Be careful: blocking AI broadly could also cost you visibility in AI answers, so make that choice deliberately.
Source: Search Engine Land
3. Ads in Google AI Mode expand, with the UK next
Google is now showing ads inside AI Mode answers in 10 more countries, including Australia, Canada and India, and says Brazil, Mexico and the United Kingdom will follow in Q4 2026. In the US it has launched “multiturn” ads that can appear on follow-up questions. Google says AI Mode queries are on average three times longer than traditional searches.
What this means for your business: If you already run Google Search ads, your ads may start appearing in AI answers. UK advertisers should review their campaigns and conversion tracking before that rollout lands.
Source: Google Ads & Commerce Blog
4. Google Business Profiles get a free AI texting agent (pilot) and new ordering controls
Google is inviting more businesses into a pilot where an AI agent answers routine customer messages sent from Search and Maps, such as opening hours or booking questions, and hands anything it can’t answer back to the owner. It only works for customers whose phones support RCS messaging. Separately, restaurants can now switch individual ordering providers like DoorDash or Uber Eats on or off for pickup and delivery right in their Business Profile dashboard.
What this means for your business: The AI agent can only answer as well as your profile is filled in, so check your hours, services and menu are accurate now. Restaurants should review which ordering links appear on their listing.
Sources: Search Engine Roundtable, Search Engine Journal
Not sure if your site runs a vulnerable plugin, or whether AI search can find your business? Try our free tools, or get in touch at hello@genwayz.com for a free site audit.