Pagelayer < 2.0.8 - Unauthenticated Email Header Injection via 'email'

Description

The plugin is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') due to the contact form handler performing placeholder substitution on attacker-controlled form fields and then passing the resulting values into email headers without removing CR/LF characters. This makes it possible for unauthenticated attackers to inject arbitrary email headers (for example Bcc / Cc) and abuse form email delivery via the 'email' parameter granted they can target a contact form configured to use placeholders in mail template headers.