Tripzzy – Travel Engine System

Tripzzy – Travel Engine System has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of November 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (100%).

Every one of the 2 issues recorded for Tripzzy – Travel Engine System has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Pablo González Pérez. Tripzzy – Travel Engine System is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Tripzzy – Travel Engine System vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-87839

Tripzzy <= 1.5.0 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records
Tripzzy – Travel Engine System banner
Latestv1.6.0

Tripzzy – Travel Engine System

Refresh Themes

Author

Refresh Themes

4.9(7)
98/100
Last Updated
2026-10-28 (11d ago)
Active Installs
100+
Downloads
13,471
Requires WP
6.6+
Requires PHP
7.4+
Tested up to
WP 7.1.4
Created
2023-11-11 (3y ago)

Travel Engine System Tripzzy is a powerful, feature-rich WordPress plugin designed for travel agencies, tour operators, and adventure businesses to create and manage their online booking platform. Built with flexibility and ease of use in mind, Tripzzy provides everything you need to showcase tours, manage bookings, and grow your travel business. View Documentation | View Demo | View Backend Demo Features Unlimited Tours & Packages – Create and manage unlimited tour packages with detailed itineraries, flexible pricing options, departure dates, and availability management for your travel booking website. Advanced Booking System – Accept online tour bookings with customizable booking forms, instant confirmations, booking management, and automated email notifications for admins and customers. Fixed & Recurring Trip Dates – Create fixed departure dates or recurring schedules with cut-off times, inventory control, and availability calendars. 25 Elementor Widgets & 20+ Gutenberg Blocks – Design single-trip pages, archive templates, and booking flows visually with drag-and-drop widgets and native blocks sharing the same templates, including Theme Builder and full-site-editing support. AI Assistant – Built-in AI REST API with memory to power smart travel assistance features. Flexible Pricing – Per-person and per-group pricing with seasonal pricing, group discounts, extra services, and discount coupons. Partial Payments – Accept partial or deposit payments at checkout with support for PayPal, bank transfer, and book-now-pay-later gateways. Trip Itineraries – Build detailed day-by-day itineraries with images, times, descriptions, and expandable layouts. Image Gallery with Video – Showcase trips with responsive galleries, sliders, masonry layouts, lightbox, and video support. Trip Maps – Display Google Maps or iframe maps with trip locations for every tour. Trip Infos & Highlights – Display key facts (accommodation, meals, transport, best season, language) and highlight bullets with icons. Trip Overview, FAQs & Difficulty Levels – Rich overview content, accordion FAQs, and configurable difficulty levels help travelers choose the right tour. Reviews & Ratings – Build trust with star ratings, review counts, threaded customer reviews, and a review submission form with rating input. Wishlist – Let travelers save favorite trips and manage them from their dashboard. Enquiry Forms & Drawer – Slide-in enquiry forms on every trip turn browsers into leads with admin email alerts. Sticky Trip Navigation – Auto-generated sticky anchor menu linking Highlights, Map, Itinerary, Gallery, Availability, FAQs, and Reviews sections. Advanced Search & Filters – Search forms, taxonomy filters (destination, type, activities), price/date/duration filters, sorting, and grid/list views for tour archive pages. Shortcodes – Trips, search, taxonomies, gallery, checkout, dashboard, and thank-you shortcodes for classic editors and page builders. Customer Dashboard – Travelers manage bookings, wishlists, and reviews from a front-end dashboard. Booking Management – Admin booking list with statuses, booking notes, cancellation, refund flows, and coupon management. Email Notifications – Booking confirmation, on-hold, cancellation, refund, and enquiry emails for admins and customers. Analytics – Booking and revenue reports with charts in the admin dashboard. Multi-Currency & Translation Ready – Configurable currency with code display, fully translatable strings, GDPR tools, and reCAPTCHA spam protection. Payment Gateway Integration – Accept payments through PayPal, bank transfer, and book-now-pay-later options. If you need help with the Tripzzy plugin, please visit our support forum on the WordPress plugin repository or the official website. We’re always happy to help! Travel Booking Themes Compatible With Tripzzy Tripzzy Verse by Refresh Themes Travel Me by Refresh Themes Contribute Tripzzy is developed and maintained by Refresh Themes. Shortcodes Tripzzy ships with ready-to-use shortcodes for classic editors, Gutenberg, Elementor, and any page builder that accepts shortcodes. Every trip-specific shortcode works on single trip templates and accepts an optional trip_id attribute to pull a section from any other trip. All attributes are optional. You can browse every shortcode, its attributes, and copy-ready examples from Tripzzy > Shortcodes in your WordPress dashboard. General [TRIPZZY_TRIPS] – Display a list of trips with optional filters for destination, type and featured trips. Attributes: posts_per_page, orderby, order, featured, trip_destination, trip_type, view_mode. [TRIPZZY_TRIP_SEARCH] – Display the trip search form anywhere on the site. Attributes: search_text, hide_price, hide_destination, hide_trip_type, hide_trip_activities. [TRIPZZY_TRIP_TAXONOMIES] – Display trip destinations, types or activities as cards. Attributes: taxonomy, number, orderby, order, enable_overlay, hide_empty. Single Trip These shortcodes display a section of one trip. Use trip_id to target a specific trip; leave it empty to use the current trip on a single trip template. Section shortcodes also support title (custom heading, empty uses the trip setting) and show_title (true or false). * [TRIPZZY_TRIP_OVERVIEW] – Display the overview (main content) of a single trip. [TRIPZZY_TRIP_INFOS] – Display the key trip facts (duration, group size, etc.) of a single trip. [TRIPZZY_TRIP_HIGHLIGHTS] – Display the highlights section of a single trip. [TRIPZZY_TRIP_ITINERARY] – Display the day-by-day itinerary of a single trip. [TRIPZZY_TRIP_INCLUDES_EXCLUDES] – Display the includes and excludes section of a single trip. [TRIPZZY_TRIP_FAQS] – Display the FAQs section of a single trip. [TRIPZZY_GALLERY] – Display the image / video gallery of a single trip. Also supports title_tag. [TRIPZZY_TRIP_MAP] – Display the map section of a single trip. [TRIPZZY_TRIP_REVIEWS] – Display the reviews list and review form of a single trip. [TRIPZZY_TRIP_CODE] – Display the trip code of a single trip. Pages & Account [TRIPZZY_CHECKOUT] – Renders the checkout form. Used on the checkout page. [TRIPZZY_THANKYOU] – Renders the booking confirmation. Used on the thank you page. [TRIPZZY_TRIP_SEARCH_RESULT] – Renders search results. Used on the search result page. [TRIPZZY_DASHBOARD] – Renders the customer dashboard (login form for guests). Used on the dashboard page. Third Party Libraries Font Awesome – Toolkit to display icons. Copyright 2025 Fonticons, Inc. Version: 7.1.0 License: https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Source: https://fontawesome.com React Google Maps API – Library to display Google Maps. Copyright (c) 2020 Alexey Lyakhov Version: 2.20.7 License: Licensed under the MIT license – https://github.com/JustFly1984/react-google-maps-api/blob/develop/LICENSE Source: https://github.com/JustFly1984/react-google-maps-api Google Maps JavaScript API Copyright (c) Google LLC License: Licensed under the Google Maps Platform Terms of Service. International Telephone Input Copyright (c) Jack O’Connor License: Licensed under the MIT license – https://github.com/jackocnr/intl-tel-input?tab=MIT-1-ov-file React Date Picker – UI component that allows you to select a date or a range of dates. Copyright (c) 2014-2025 HackerOne Inc. and individual contributors Version: 8.0.0 License: Licensed under the MIT license – https://github.com/Hacker0x01/react-datepicker/blob/main/LICENSE Source: https://github.com/Hacker0x01/react-datepicker React Select – Library for building custom, accessible, and flexible select inputs for React applications. Copyright (c) 2022 Jed Watson Version: 5.10.0 License: Licensed under the MIT license – https://github.com/JedWatson/react-select/blob/master/LICENSE Source: https://github.com/JedWatson/react-select Rrule – It is used to define recurring events or schedules in a calendar. Copyright 2010, Jakub Roztocil jakub@roztocil.name and Lars Schöning Version: 2.8.1 License: Licensed under the BSD-3-Clause – https://github.com/jkbrzt/rrule/blob/master/LICENCE Source: https://github.com/jkbrzt/rrule Paypal js – Render Paypal Payment button to checkout. Copyright 2020 PayPal License: Apache License – https://github.com/paypal/paypal-js/blob/main/LICENSE Source: https://github.com/paypal/paypal-js React Sortablejs – Library to sort HTML elements. Copyright (c) 2020 All contributors to react-sortablejs Version: 6.1.4 License: Licensed under the MIT license – https://github.com/SortableJS/react-sortablejs/blob/master/LICENSE Source: https://github.com/SortableJS/react-sortablejs Flatpickr – lightweight, powerful javascript datetimepicker with no dependencies. Copyright (c) 2017 Gregory Petrosyan Version: 4.6.13 License: Licensed under the MIT license – https://github.com/flatpickr/flatpickr/blob/master/LICENSE.md Source: https://github.com/flatpickr/flatpickr Chartjs – Simple HTML5 Charts using the canvas tag Copyright (c) 2025 Chart.js Contributors Version: 4.5.1 License: Licensed under the MIT license – https://github.com/chartjs/Chart.js/blob/master/LICENSE.md Source: https://github.com/chartjs/Chart.js Tripzzy Themes API – This API is used to fetch Tripzzy compatible themes. Copyright Tripzzy License: Licensed under the GNU General Public License v2 or later – https://wptripzzy.com/terms-of-services Source: https://wptripzzy.com/wp-json/wp/v2/tripzzy-themes Images https://pxhere.com/en/photo/675325 https://pxhere.com/en/photo/1250151 https://pxhere.com/en/photo/910019 https://pxhere.com/en/photo/1122255 https://pxhere.com/en/photo/1200073 https://pxhere.com/en/photo/956893 https://pxhere.com/en/photo/1160853 https://pxhere.com/en/photo/780366 https://pxhere.com/en/photo/932224 https://pxhere.com/en/photo/675349 https://pxhere.com/en/photo/701261 https://pxhere.com/en/photo/794319

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C