Tripzzy – Travel Engine System

Tripzzy – Travel Engine System has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (100%).

Every one of the 2 issues recorded for Tripzzy – Travel Engine System has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Pablo González Pérez. Tripzzy – Travel Engine System is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.2.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Tripzzy – Travel Engine System vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-87839

Tripzzy <= 1.5.0 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records
Tripzzy – Travel Engine System banner
Latestv1.5.1

Tripzzy – Travel Engine System

Refresh Themes

Author

Refresh Themes

4.9(7)
98/100
Last Updated
2026-09-17 (6d ago)
Active Installs
100+
Downloads
12,647
Requires WP
6.6+
Requires PHP
7.4+
Tested up to
WP 7.1.2
Created
2023-11-11 (3y ago)

Travel Engine System Tripzzy is a powerful, feature-rich WordPress plugin designed for travel agencies, tour operators, and adventure businesses to create and manage their online booking platform. Built with flexibility and ease of use in mind, Tripzzy provides everything you need to showcase tours, manage bookings, and grow your travel business. View Documentation | View Demo | View Backend Demo Features Unlimited Tours & Packages: – Create and manage unlimited tour packages with detailed itineraries, pricing options, and dates availability. Advanced Booking System – Accept online bookings with customizable booking forms, instant confirmations, and automated email notifications. Trip dates – Create and manage fixed and recurring trip dates. Discount coupon – Tripzzy allows you to add coupons for the trips. Display trip infos – Display additional infos according to trip. Trip itineraries – Create detailed day-by-day itineraries with images, descriptions, and activity highlights. Image gallery – Add and display the trip gallery. Trip map – Display Google map or iframe map for each trip. Trip difficulties – Display the trip difficulty level for the users. Review & Rating System – Build trust with authentic customer reviews and ratings for your tours. Search form shortcode – Search Shortcodes help find the desired trips as per your search parameters. Trip Filters – Use the existing search filters or create custom filters to let your customers find the matching trip. Enquiry form – Customer can easily send their enquiry for the trips by filling in the enquiry form. You can now get more Inquiries about your trip packages. User Dashboard – User Dashboard helps you to find your bookings, wishlists, reviews, etc. Translation ready – The plugin is fully translation ready. So feel free to translate your website into your own or any other language. Payment Gateway Integration – Accept payments through popular gateways including PayPal, Stripe, and bank transfers. If you need help with the Tripzzy plugin, please visit our support forum on the WordPress plugin repository or the official website. We’re always happy to help! Travel Booking Themes Compatible With Tripzzy Tripzzy Verse by Refresh Themes Travel Me by Refresh Themes Contribute Tripzzy is developed and maintained by Refresh Themes. Third Party Libraries Font Awesome – Toolkit to display icons. Copyright 2025 Fonticons, Inc. Version: 7.1.0 License: https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Source: https://fontawesome.com React Google Maps API – Library to display Google Maps. Copyright (c) 2020 Alexey Lyakhov Version: 2.20.7 License: Licensed under the MIT license – https://github.com/JustFly1984/react-google-maps-api/blob/develop/LICENSE Source: https://github.com/JustFly1984/react-google-maps-api Google Maps JavaScript API Copyright (c) Google LLC License: Licensed under the Google Maps Platform Terms of Service. React Date Picker – UI component that allows you to select a date or a range of dates. Copyright (c) 2014-2025 HackerOne Inc. and individual contributors Version: 8.0.0 License: Licensed under the MIT license – https://github.com/Hacker0x01/react-datepicker/blob/main/LICENSE Source: https://github.com/Hacker0x01/react-datepicker React Select – Library for building custom, accessible, and flexible select inputs for React applications. Copyright (c) 2022 Jed Watson Version: 5.10.0 License: Licensed under the MIT license – https://github.com/JedWatson/react-select/blob/master/LICENSE Source: https://github.com/JedWatson/react-select Rrule – It is used to define recurring events or schedules in a calendar. Copyright 2010, Jakub Roztocil &#x6a;&#097;&#x6b;&#117;&#x62;&#064;&#x72;&#111;&#x7a;&#116;&#x6f;&#099;&#x69;&#108;&#x2e;&#110;&#x61;&#109;&#x65; and Lars Schöning Version: 2.8.1 License: Licensed under the BSD-3-Clause – https://github.com/jkbrzt/rrule/blob/master/LICENCE Source: https://github.com/jkbrzt/rrule Paypal js – Render Paypal Payment button to checkout. Copyright 2020 PayPal License: Apache License – https://github.com/paypal/paypal-js/blob/main/LICENSE Source: https://github.com/paypal/paypal-js React Sortablejs – Library to sort HTML elements. Copyright (c) 2020 All contributors to react-sortablejs Version: 6.1.4 License: Licensed under the MIT license – https://github.com/SortableJS/react-sortablejs/blob/master/LICENSE Source: https://github.com/SortableJS/react-sortablejs Flatpickr – lightweight, powerful javascript datetimepicker with no dependencies. Copyright (c) 2017 Gregory Petrosyan Version: 4.6.13 License: Licensed under the MIT license – https://github.com/flatpickr/flatpickr/blob/master/LICENSE.md Source: https://github.com/flatpickr/flatpickr Chartjs – Simple HTML5 Charts using the canvas tag Copyright (c) 2025 Chart.js Contributors Version: 4.5.1 License: Licensed under the MIT license – https://github.com/chartjs/Chart.js/blob/master/LICENSE.md Source: https://github.com/chartjs/Chart.js Tripzzy Themes API – This API is used to fetch Tripzzy compatible themes. Copyright Tripzzy License: Licensed under the GNU General Public License v2 or later – https://wptripzzy.com/terms-of-services Source: https://wptripzzy.com/wp-json/wp/v2/tripzzy-themes Images https://pxhere.com/en/photo/675325 https://pxhere.com/en/photo/1250151 https://pxhere.com/en/photo/910019 https://pxhere.com/en/photo/1122255 https://pxhere.com/en/photo/1200073 https://pxhere.com/en/photo/956893 https://pxhere.com/en/photo/1160853 https://pxhere.com/en/photo/780366 https://pxhere.com/en/photo/932224 https://pxhere.com/en/photo/675349 https://pxhere.com/en/photo/701261 https://pxhere.com/en/photo/794319

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C