Research andfield notes.

New critical CVEs NVD · 14 days

• 9.8 CVE-2026-109220 The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injec… 2026-10-31
• 9.8 CVE-2026-116512 The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress … 2026-10-31
• 9.8 CVE-2026-119096 The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and in… 2026-10-31
• 9.8 CVE-2026-118235 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerabl… 2026-10-31
• 9.1 CVE-2026-116557 The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to… 2026-10-31
• 9.1 CVE-2026-89270 The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to a… 2026-10-31
• 9.1 CVE-2026-103882 The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitr… 2026-10-31
• 9.3 CVE-2026-119597 OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to… 2026-10-30