CVE-2026-2442

The record

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 2.0.7. This is due to the contact form handler performing placeholder substitution on attacker-controlled form fields and then passing the resulting values into email headers without removing CR/LF characters. This makes it possible for unauthenticated attackers to inject arbitrary email headers (for example Bcc / Cc) and abuse form email delivery via the 'email' parameter granted they can target a contact form configured to use placeholders in mail template headers.

Affected packages

Related vulnerabilities

• CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
• CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93
• CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. CWE-93
• CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters… CWE-93
• CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks… CWE-93
• CVE-2026-48019 Laravel is a web application framework. CWE-93
• CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows… CWE-93
• CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. CWE-93