diff --git a/advisories/unreviewed/2025/02/GHSA-pg65-86gh-q227/GHSA-pg65-86gh-q227.json b/advisories/unreviewed/2025/02/GHSA-pg65-86gh-q227/GHSA-pg65-86gh-q227.json
new file mode 100644
index 00000000000..98a5f3872f7
--- /dev/null
+++ b/advisories/unreviewed/2025/02/GHSA-pg65-86gh-q227/GHSA-pg65-86gh-q227.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pg65-86gh-q227",
+  "modified": "2025-04-18T03:31:21Z",
+  "published": "2025-02-04T15:31:38Z",
+  "aliases": [
+    "CVE-2025-22664"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS. This issue affects Survey Maker: from n/a through 5.1.3.5.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22664"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-04T15:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/02/GHSA-qqm5-4wx3-f56x/GHSA-qqm5-4wx3-f56x.json b/advisories/unreviewed/2025/02/GHSA-qqm5-4wx3-f56x/GHSA-qqm5-4wx3-f56x.json
index 2f3a34ded50..376f03350c8 100644
--- a/advisories/unreviewed/2025/02/GHSA-qqm5-4wx3-f56x/GHSA-qqm5-4wx3-f56x.json
+++ b/advisories/unreviewed/2025/02/GHSA-qqm5-4wx3-f56x/GHSA-qqm5-4wx3-f56x.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2025/04/GHSA-c2rf-m726-rrr8/GHSA-c2rf-m726-rrr8.json b/advisories/unreviewed/2025/04/GHSA-c2rf-m726-rrr8/GHSA-c2rf-m726-rrr8.json
new file mode 100644
index 00000000000..1b3391f3751
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-c2rf-m726-rrr8/GHSA-c2rf-m726-rrr8.json
@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c2rf-m726-rrr8",
+  "modified": "2025-04-18T03:31:22Z",
+  "published": "2025-04-18T03:31:22Z",
+  "aliases": [
+    "CVE-2025-0467"
+  ],
+  "details": "Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0467"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-823"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-18T01:15:32Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-cfqc-4q39-jp6f/GHSA-cfqc-4q39-jp6f.json b/advisories/unreviewed/2025/04/GHSA-cfqc-4q39-jp6f/GHSA-cfqc-4q39-jp6f.json
new file mode 100644
index 00000000000..73f7c2fad19
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-cfqc-4q39-jp6f/GHSA-cfqc-4q39-jp6f.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cfqc-4q39-jp6f",
+  "modified": "2025-04-18T03:31:22Z",
+  "published": "2025-04-18T03:31:22Z",
+  "aliases": [
+    "CVE-2025-2613"
+  ],
+  "details": "The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2613"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/customized-login/trunk/customized-login.php#L199"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-18T02:15:14Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-fgvj-q3hx-cpwr/GHSA-fgvj-q3hx-cpwr.json b/advisories/unreviewed/2025/04/GHSA-fgvj-q3hx-cpwr/GHSA-fgvj-q3hx-cpwr.json
new file mode 100644
index 00000000000..1b39970ac1c
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-fgvj-q3hx-cpwr/GHSA-fgvj-q3hx-cpwr.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fgvj-q3hx-cpwr",
+  "modified": "2025-04-18T03:31:22Z",
+  "published": "2025-04-18T03:31:22Z",
+  "aliases": [
+    "CVE-2025-25427"
+  ],
+  "details": "A Stored cross-site scripting (XSS)\nvulnerability in upnp page of the web Interface in TP-Link WR841N <=4.19\nallows remote attackers to inject arbitrary JavaScript code via the port\nmapping description. This leads to \n\nan execution of the JavaScript payload when the upnp page is loaded.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25427"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/slin99/2025-25427"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-18T01:15:32Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-m9p6-4vvj-3w8m/GHSA-m9p6-4vvj-3w8m.json b/advisories/unreviewed/2025/04/GHSA-m9p6-4vvj-3w8m/GHSA-m9p6-4vvj-3w8m.json
new file mode 100644
index 00000000000..578d94e30a3
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-m9p6-4vvj-3w8m/GHSA-m9p6-4vvj-3w8m.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m9p6-4vvj-3w8m",
+  "modified": "2025-04-18T03:31:22Z",
+  "published": "2025-04-18T03:31:22Z",
+  "aliases": [
+    "CVE-2025-3520"
+  ],
+  "details": "The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/avatar/trunk/avatar.php#L417"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/avatar"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01769760-5bfe-4352-bc5b-141f078c0b6d?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-18T02:15:14Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-mxvp-mc7m-q699/GHSA-mxvp-mc7m-q699.json b/advisories/unreviewed/2025/04/GHSA-mxvp-mc7m-q699/GHSA-mxvp-mc7m-q699.json
new file mode 100644
index 00000000000..4a4a72965b8
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-mxvp-mc7m-q699/GHSA-mxvp-mc7m-q699.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mxvp-mc7m-q699",
+  "modified": "2025-04-18T03:31:22Z",
+  "published": "2025-04-18T03:31:22Z",
+  "aliases": [
+    "CVE-2024-13650"
+  ],
+  "details": "The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13650"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/piotnet-addons-for-elementor"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3d0ffd-209b-4e29-bc1d-91f2498b4632?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-18T02:15:14Z"
+  }
+}
\ No newline at end of file