PatchTheCVE: configured commercehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-22387: An issue was discovered in Optimizely Configured Commerce before 5.2.2408https://patchthecve.com/cve/CVE-2025-22387.htmlhttps://patchthecve.com/cve/CVE-2025-22387.htmlWed, 17 Jun 2026 08:46:57 +0000HIGH 7.5: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.CVE-2025-22386: An issue was discovered in Optimizely Configured Commerce before 5.2.2408https://patchthecve.com/cve/CVE-2025-22386.htmlhttps://patchthecve.com/cve/CVE-2025-22386.htmlWed, 17 Jun 2026 08:46:57 +0000HIGH 7.3: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.CVE-2025-22385: An issue was discovered in Optimizely Configured Commerce before 5.2.2408https://patchthecve.com/cve/CVE-2025-22385.htmlhttps://patchthecve.com/cve/CVE-2025-22385.htmlWed, 17 Jun 2026 08:46:56 +0000MEDIUM 5.9: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefrontCVE-2025-22384: An issue was discovered in Optimizely Configured Commerce before 5.2.2408https://patchthecve.com/cve/CVE-2025-22384.htmlhttps://patchthecve.com/cve/CVE-2025-22384.htmlWed, 17 Jun 2026 08:46:56 +0000HIGH 7.5: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching theCVE-2025-22383: An issue was discovered in Optimizely Configured Commerce before 5.2.2408https://patchthecve.com/cve/CVE-2025-22383.htmlhttps://patchthecve.com/cve/CVE-2025-22383.htmlWed, 17 Jun 2026 08:46:55 +0000MEDIUM 4.6: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenaCVE-2024-56175: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed https://patchthecve.com/cve/CVE-2024-56175.htmlhttps://patchthecve.com/cve/CVE-2024-56175.htmlWed, 17 Jun 2026 08:11:47 +0000MEDIUM 6.1: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names.CVE-2024-56174: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed https://patchthecve.com/cve/CVE-2024-56174.htmlhttps://patchthecve.com/cve/CVE-2024-56174.htmlWed, 17 Jun 2026 08:11:47 +0000HIGH 8.1: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.CVE-2024-56173: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed https://patchthecve.com/cve/CVE-2024-56173.htmlhttps://patchthecve.com/cve/CVE-2024-56173.htmlWed, 17 Jun 2026 08:11:46 +0000MEDIUM 4.7: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document.