diff --git a/advisories/unreviewed/2025/03/GHSA-3frh-5xx6-qrgx/GHSA-3frh-5xx6-qrgx.json b/advisories/unreviewed/2025/03/GHSA-3frh-5xx6-qrgx/GHSA-3frh-5xx6-qrgx.json
new file mode 100644
index 00000000000..c9087ed2772
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-3frh-5xx6-qrgx/GHSA-3frh-5xx6-qrgx.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3frh-5xx6-qrgx",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2025-1435"
+  ],
+  "details": "The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbp_user_add_role_on_register() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Rather than implementing a nonce check to provide protection against this vulnerability, which would break functionality, the plugin no longer makes it possible to select a role during registration.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1435"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/bbpress/trunk/includes/users/signups.php#L151"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3247345/bbpress/branches/2.6/includes/users/capabilities.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247345%40bbpress&new=3247345%40bbpress&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d776d94-8c81-4e88-bae3-946824a75c09?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-557c-c52f-8p63/GHSA-557c-c52f-8p63.json b/advisories/unreviewed/2025/03/GHSA-557c-c52f-8p63/GHSA-557c-c52f-8p63.json
new file mode 100644
index 00000000000..5d7a95e458a
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-557c-c52f-8p63/GHSA-557c-c52f-8p63.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-557c-c52f-8p63",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2024-13827"
+  ],
+  "details": "The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and remove_query_arg() functions without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13827"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/razorpay-subscription-button-elementor/tags/1.0.3/includes/rzp-payment-buttons.php#L78"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/razorpay-subscription-button-elementor/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8cdde8d-db43-4702-81c3-ea2d867baa8d?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-f8hf-x5x5-6vgr/GHSA-f8hf-x5x5-6vgr.json b/advisories/unreviewed/2025/03/GHSA-f8hf-x5x5-6vgr/GHSA-f8hf-x5x5-6vgr.json
new file mode 100644
index 00000000000..a80af13ac93
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-f8hf-x5x5-6vgr/GHSA-f8hf-x5x5-6vgr.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f8hf-x5x5-6vgr",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2024-8682"
+  ],
+  "details": "The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enabled prior to creating a user though the register_handler() function. This makes it possible for unauthenticated attackers to register as a user even when user registration is disabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8682"
+    },
+    {
+      "type": "WEB",
+      "url": "https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0d7ee7-a358-4487-a0cc-31ed810ae8bc?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-mv7q-mm4h-856r/GHSA-mv7q-mm4h-856r.json b/advisories/unreviewed/2025/03/GHSA-mv7q-mm4h-856r/GHSA-mv7q-mm4h-856r.json
new file mode 100644
index 00000000000..92fac6777e4
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-mv7q-mm4h-856r/GHSA-mv7q-mm4h-856r.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mv7q-mm4h-856r",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2025-1393"
+  ],
+  "details": "An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1393"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-021"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-798"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T08:15:35Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-pw2f-j76p-vrqv/GHSA-pw2f-j76p-vrqv.json b/advisories/unreviewed/2025/03/GHSA-pw2f-j76p-vrqv/GHSA-pw2f-j76p-vrqv.json
new file mode 100644
index 00000000000..72769d71264
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-pw2f-j76p-vrqv/GHSA-pw2f-j76p-vrqv.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pw2f-j76p-vrqv",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2024-13350"
+  ],
+  "details": "The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13350"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/searchiq/trunk/library/shortcode.php#L132"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/searchiq"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a04f074c-448d-4c5f-ae46-0ad1a3effdb4?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-r264-rp4f-mc9j/GHSA-r264-rp4f-mc9j.json b/advisories/unreviewed/2025/03/GHSA-r264-rp4f-mc9j/GHSA-r264-rp4f-mc9j.json
new file mode 100644
index 00000000000..91da67ce5f4
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-r264-rp4f-mc9j/GHSA-r264-rp4f-mc9j.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r264-rp4f-mc9j",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2025-1008"
+  ],
+  "details": "The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1008"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/recently-purchased-products-for-woo/tags/1.1.3/includes/class-rppw-public.php#L160"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/recently-purchased-products-for-woo/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebcd32-90c1-419c-a67c-6fe41ee9fab1?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-vvj9-853g-mgc8/GHSA-vvj9-853g-mgc8.json b/advisories/unreviewed/2025/03/GHSA-vvj9-853g-mgc8/GHSA-vvj9-853g-mgc8.json
new file mode 100644
index 00000000000..9a51ff5892a
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-vvj9-853g-mgc8/GHSA-vvj9-853g-mgc8.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vvj9-853g-mgc8",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2024-13866"
+  ],
+  "details": "The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13866"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/simple-notification/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e814f798-5ebc-4bea-838f-d0a803f9bdbc?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-wwgp-82c5-fmmh/GHSA-wwgp-82c5-fmmh.json b/advisories/unreviewed/2025/03/GHSA-wwgp-82c5-fmmh/GHSA-wwgp-82c5-fmmh.json
new file mode 100644
index 00000000000..e3b55354dad
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-wwgp-82c5-fmmh/GHSA-wwgp-82c5-fmmh.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wwgp-82c5-fmmh",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2025-0990"
+  ],
+  "details": "The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the iamgloria23_gloria_settings_page function. This makes it possible for unauthenticated attackers to reset the tenant ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0990"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/gloria-assistant-by-webtronic-labs"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33fd44dc-b4f8-4429-8dcd-5161602bb318?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-xg72-j456-mcj9/GHSA-xg72-j456-mcj9.json b/advisories/unreviewed/2025/03/GHSA-xg72-j456-mcj9/GHSA-xg72-j456-mcj9.json
new file mode 100644
index 00000000000..99966d18171
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-xg72-j456-mcj9/GHSA-xg72-j456-mcj9.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xg72-j456-mcj9",
+  "modified": "2025-03-05T09:30:52Z",
+  "published": "2025-03-05T09:30:52Z",
+  "aliases": [
+    "CVE-2025-22493"
+  ],
+  "details": "Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22493"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1009.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-319"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-05T09:15:10Z"
+  }
+}
\ No newline at end of file