Ronnachai Chaipha (rxnr)

Ronnachai Chaipha (rxnr) is a security researcher credited with 13 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #414 of 3,908 contributors. The disclosure was published in 2026.

Their research concentrates on Cross-Site Scripting, which accounts for 4 of their findings (31%). Other recurring categories include Improper Input Validation, Missing Authorization. The average CVSS score across these disclosures is 5.8, peaking at 8.8. Severity breakdown: 0 critical and 3 high.

The most affected software includes MailArchiver (2), Accessibly (1), Activity Logs (1), across 12 distinct plugins, themes and core versions in total.

7 of the 13 disclosed issues have a vendor fix, while 6 remain unpatched. The most severe finding, "CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter", scores 8.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#414

of 3,908 researchers

Vulns

Critical0

High3

Medium10

Low0

Affected Assets

12plugins

Avg CVSS

5.8

Average score of vulnerabilities

Researcher Submissions

13 records


2026-10-14 00:00	WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration' WholesaleX <= 3.0.8	`CVE-2026-8145`	5.4 Medium	Ronnachai Chaipha (rxnr)	Yes
2026-07-10 14:43	Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter Planyo online reservation system <= 3.0	`CVE-2026-3576`	7.2 High	chaeyp	Yes
2026-05-11 19:04	Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute Shortcodely <= 1.0.1	`CVE-2026-6913`	6.4 Medium	chaeyp	No
2026-05-08 23:40	Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API Activity Logs <= 3.3.6	`CVE-2026-8198`	5.3 Medium	Ronnachai Chaipha (rxnr)	Yes
2026-04-14 19:47	Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API Accessibly <= 3.0.3	`CVE-2026-3643`	7.2 High	chaeyp	No
2026-03-20 15:14	CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter CMS Commander <= 2.288	`CVE-2026-3334`	8.8 High	chaeyp	No
2026-03-20 15:10	Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint Appmax <= 1.0.3	`CVE-2026-3641`	5.3 Medium	chaeyp	No
2026-03-20 15:10	Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action Build App Online <= 1.0.23	`CVE-2026-3651`	5.3 Medium	Ronnachai Sretawat Na Ayutaya (Simonhaskelly)	No
2026-03-20 15:10	REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter REST API TO MiniProgram <= 5.1.2	`CVE-2026-3460`	5.3 Medium	Ronnachai Sretawat Na Ayutaya (Simonhaskelly)	No
2026-03-20 00:00	RepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action RepairBuddy <= 4.1132	`CVE-2026-3567`	5.3 Medium	chaeyp	Yes

Showing 1–10 of 13 reports