Booking for Appointments and Events Calendar – Amelia

by Melograno Venture Studio

View on WordPress.org

83 Quality Score

Active Installs

22/30

At 90,000 active installs it ranks in the upper tier of booking plugins, just behind LatePoint's 100,000.

Update Freshness

25/25

Updated in July 2026 and tested against recent releases, the maintenance signal is very strong.

User Rating

14/15

A 92/100 score from 773 reviewers reflects consistently positive user experiences.

Support Health

8/15

Only 9 public support threads with 66.7% resolved is a small sample, so the mid-range support score should be read with caution rather than as evidence of weak support.

WP Compatibility

15/15

Requires PHP 7.4 and WordPress 6.5 or newer, with WP 7.0 tested, so confirm your hosting stack is current before installing.

Scores higher than 92% of indexed plugins

About

Amelia is a powerful booking plugin for appointments and events. Manage scheduling, calendars, and availability with an all-in-one booking system.

Active Installs 90k+

Rating ★★★★½ 4.6/5

Last Updated 2026-09-24 11:59am GMT

Requires WordPress 6.5+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

48 known vulnerabilities, all patched

1 Critical 9 High 38 Medium

Most recent: September 17, 2026

View details ▸

Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover Medium

September 17, 2026 Patched in ["2.4.5"] CVE-2026-14311

Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass Medium

September 17, 2026 Patched in ["2.4.6"] CVE-2026-16582

Booking for Appointments and Events Calendar – Amelia < 2.4.10 - Authenticated (Custom Role+) Privilege Escalation Medium

September 14, 2026 Patched in ["2.4.10"] CVE-2026-77705

Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter Medium

September 11, 2026 Patched in ["2.4.10"] CVE-2026-10148

Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Editor+) SQL Injection Medium

September 11, 2026 Patched in ["2.4.10"] CVE-2026-62112

Booking for Appointments and Events Calendar – Amelia 9.0 - 9.8.0 - Unauthenticated Payment Bypass Medium

September 10, 2026 Patched in ["9.8.1"] CVE-2026-77689

Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' Critical

September 1, 2026 Patched in ["9.6.3"] CVE-2026-9055

Booking for Appointments and Events Calendar – Amelia < 2.4.9 - Missing Authorization Medium

August 31, 2026 Patched in ["2.4.9"] CVE-2026-14215

Booking for Appointments and Events Calendar – Amelia 1.2.32 - 2.4.8 - Missing Authorization Medium

August 29, 2026 Patched in ["2.4.9"] CVE-2026-77704

Booking for Appointments and Events Calendar – Amelia 9.0 - 9.7 - Authenticated (Provider+) Arbitrary Provider Password Update Medium

August 28, 2026 Patched in ["9.8"] CVE-2026-14212

Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission High

August 27, 2026 Patched in ["2.2.1"] CVE-2026-6286

Booking for Appointments and Events Calendar – Amelia < 2.4.7 - Missing Authorization Medium

August 26, 2026 Patched in ["2.4.7"] CVE-2026-14216

Booking for Appointments and Events Calendar – Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure Medium

August 14, 2026 Patched in ["2.4.6"] CVE-2026-14213

Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure Medium

August 7, 2026 Patched in ["9.7"] CVE-2026-14211

Booking for Appointments and Events Calendar – Amelia < 2.4.4 - Missing Authorization Medium

August 1, 2026 Patched in ["2.4.4"] CVE-2026-14214

Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import Medium

July 16, 2026 Patched in ["2.4.4"] CVE-2026-14782

Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection High

July 8, 2026 Patched in ["2.4.3"] CVE-2026-57702

Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation High

June 2, 2026 Patched in ["2.4"] CVE-2026-48889

Booking for Appointments and Events Calendar – Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint Medium

May 1, 2026 Patched in ["2.3"] CVE-2026-6449

Booking for Appointments and Events Calendar – Amelia <= 2.2 - Missing Authorization Medium

April 28, 2026 Patched in ["2.2.1"] CVE-2026-40795

Booking for Appointments and Events Calendar – Amelia <= 2.2 - Unauthenticated Information Exposure Medium

April 23, 2026 Patched in ["2.2.1"] CVE-2026-40789

Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter High

April 6, 2026 Patched in ["2.2"] CVE-2026-5465

Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter Medium

March 31, 2026 Patched in ["2.1.3"] CVE-2026-4668

Amelia Booking 8.3 - 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change High

March 25, 2026 Patched in ["9.2"] CVE-2026-2931

Amelia <= 2.1.1 - Authenticated (Custom role+) SQL Injection Medium

March 25, 2026 Patched in ["2.1.2"] CVE-2026-39487

Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Authenticated (Employee+) Privilege Escalation High

March 4, 2026 Patched in ["2.0"] CVE-2026-24963

Amelia <= 1.2.38 - Missing Authorization Medium

January 11, 2026 Patched in ["2.0"] CVE-2026-24967

Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions Medium

January 8, 2026 Patched in ["2.0.0"] CVE-2025-14720

Amelia 1.2.18 - 1.2.36 - Unauthenticated Sensitive Information Exposure Medium

November 18, 2025 Patched in ["1.2.37"] CVE-2023-49282

Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search High

November 15, 2025 Patched in ["1.2.36"] CVE-2025-12482

Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure Medium

March 27, 2025 Patched in ["1.2.20"] CVE-2025-2578

Amelia <= 1.2.16 - Unauthenticated Insecure Direct Object Reference Medium

February 23, 2025 Patched in ["1.2.17"] CVE-2025-26965

Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure Medium

September 4, 2024 Patched in ["1.2.5"] CVE-2024-6332

Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure Medium

August 7, 2024 Patched in ["1.2.1"] CVE-2024-6552

Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

June 20, 2024 Patched in ["1.1.6"] CVE-2024-6225

Amelia <= 1.0.95 - Cross-Site Request Forgery Medium

April 10, 2024 Patched in ["1.0.96"] CVE-2024-31425

Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting Medium

February 29, 2024 Patched in ["1.0.99"] CVE-2024-1484

Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Medium

January 18, 2024 Patched in ["1.0.94"] CVE-2023-6808

Amelia <= 1.0.98 - Missing Authorization Medium

January 17, 2024 Patched in ["1.0.99"] CVE-2024-22298

Booking for Appointments and Events Calendar – Amelia <= 1.0.85 - Stored Cross-Site Scripting via Shortcode Medium

December 22, 2023 Patched in ["1.0.86"] CVE-2023-50860

Amelia <= 1.0.75 - Unauthenticated Reflected Cross-Site Scripting via 'code' Medium

April 6, 2023 Patched in ["1.0.76"] CVE-2023-29427

Appointment and Event Booking Calendar for WordPress – Amelia < 1.0.49 - Arbitrary Booking Update and Sensitive Data Exposure Medium

March 14, 2022 Patched in ["1.0.49"] CVE-2022-0825

Appointment and Event Booking Calendar for WordPress – Amelia <= 1.0.47 - Information Disclosure and SMS Spam Medium

March 14, 2022 Patched in ["1.0.48"] CVE-2022-0837

Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName High

March 2, 2022 Patched in ["1.0.47"] CVE-2022-0834

Appointment and Event Booking Calendar for WordPress - Amelia < 1.0.47 - Arbitrary Booking Update and Sensitive Data Exposure Medium

March 1, 2022 Patched in ["1.0.47"] CVE-2022-0720

Amelia <= 1.0.46 - Cross-Site Request Forgery Medium

February 23, 2022 Patched in ["1.0.47"] CVE-2022-0616

Amelia <= 1.0.46 - Reflected Cross-Site Scripting Medium

February 23, 2022 Patched in ["1.0.47"] CVE-2022-0627

Appointment and Event Booking Calendar - Amelia < 1.0.47 - Arbitrary File Upload High

February 23, 2022 Patched in ["1.0.47"] CVE-2022-0687

What It Does

Amelia is an all-in-one booking plugin for WordPress that handles appointment scheduling, calendar management, and event registration through a single dashboard. Site owners configure services, staff, working hours, and availability rules, then accept bookings via front-end forms. It also supports recurring bookings, group events, and email/SMS notifications out of the box.

Who It's For

This is built for service-based businesses such as salons, clinics, consultants, fitness studios, and tutors who need a polished, self-hosted booking experience on WordPress. It suits shops that want to manage multiple employees, services, and locations without paying per-booking SaaS fees. Smaller solo operators can use it too, though they may not tap the full feature set.

Who Should Skip It

If you run a simple contact form or a single personal calendar, Amelia is overkill and adds administrative weight you do not need. Sites stuck on PHP 7.3 or older cannot run it, and anyone wanting deep WooCommerce product integration should look elsewhere since booking-focused scheduling is its primary job.

The Bottom Line

Amelia earns its Overall Quality Score of 83.49/100 by combining strong ratings, modern maintenance, and the second-largest install base in the category. It is a solid pick for service businesses that need a self-hosted booking system and are comfortable with a feature-rich admin. Shoppers should weigh it against LatePoint for simplicity or Bookly for ecosystem depth before committing.

Pick LatePoint if you want a leaner, faster dashboard focused on one-on-one appointments and marginally higher install credibility.

Appointment Booking Calendar — Simply Schedule Appointments 84/100

Choose Simply Schedule Appointments if you prefer a lighter interface, tighter Google Calendar sync, and fewer configuration screens.

Online Scheduling and Appointment Booking System – Bookly

Go with Bookly if you want the largest community and broadest catalogue of paid add-ons for niche verticals.

WP Booking System – Booking Calendar 81/100

Pick WP Booking System if your primary need is a visual day-by-day booking calendar rather than a full customer-facing scheduling flow.

SimplyBook.me – Booking and reservations calendar 81/100

Choose SimplyBook.me if you would rather offload booking logic to a hosted service and only embed it into WordPress.