Unknown JetFormBuilder

• CVE-2026-19862 Medium 4.8 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action 0.2%
• CVE-2026-19859 Medium 6.5 JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter 0.3%