Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

85 Quality Score

Active Installs

23/30

With 100,000 active installs, LatePoint has a meaningfully larger user base than most direct competitors, including Amelia and Bookly.

Update Freshness

25/25

A recent update timestamp of July 2026 indicates the developer is actively shipping changes, which is reflected in a perfect maintenance score.

User Rating

15/15

A 98 out of 100 rating across 91 reviews is exceptional and suggests a highly satisfied user base.

Support Health

8/15

Only 2 support threads exist, both resolved, which is a thin sample size and limits confidence in long-term support responsiveness.

WP Compatibility

15/15

Full marks for compatibility, backed by explicit support for WordPress 6.5 and PHP 7.4, with testing on WordPress 7.0.1.

Scores higher than 95% of indexed plugins

About

Appointment scheduling & event booking plugin for WordPress. Let clients self-schedule 24/7, register for events, and pay at booking.

Active Installs 100k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-23 10:19am GMT

Requires WordPress 6.5+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

41 known vulnerabilities, all patched

4 Critical 13 High 24 Medium

Most recent: September 17, 2026

View details ▸

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) Medium

September 17, 2026 Patched in ["5.6.4"] CVE-2026-13471

LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter Medium

September 17, 2026 Patched in ["5.6.10"] CVE-2026-18441

LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Medium

August 5, 2026 Patched in ["5.4.0"] CVE-2026-5391

LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment Medium

July 10, 2026 Patched in ["5.6.8"] CVE-2026-15250

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection High

July 8, 2026 Patched in ["5.6.4"] CVE-2026-57714

LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass High

July 7, 2026 Patched in ["5.4.1"] CVE-2026-5356

LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step Medium

July 2, 2026 Patched in ["5.6.2"] CVE-2026-11398

LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter Medium

July 1, 2026 Patched in ["5.6.3"] CVE-2026-12657

LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter High

June 30, 2026 Patched in ["5.6.4"] CVE-2026-13228

LatePoint <= 5.6.2 - Cross-Site Request Forgery Medium

June 25, 2026 Patched in ["5.6.3"] CVE-2026-11866

LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset High

June 15, 2026 Patched in ["5.5.2"] CVE-2026-8176

LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action Medium

June 5, 2026 Patched in ["5.6.1"] CVE-2026-9719

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation High

June 5, 2026 Patched in ["5.5.2"] CVE-2026-49083

LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route Medium

May 13, 2026 Patched in ["5.4.0"] CVE-2026-5365

LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism Medium

May 8, 2026 Patched in ["5.5.1"] CVE-2026-7652

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting High

May 6, 2026 Patched in ["5.5.1"] CVE-2026-7448

LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter High

May 5, 2026 Patched in ["5.5.1"] CVE-2026-7332

LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update Medium

May 5, 2026 Patched in ["5.5.1"] CVE-2026-7457

LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter High

May 5, 2026 Patched in ["5.5.1"] CVE-2026-7448

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability High

April 27, 2026 Patched in ["5.4.2"] CVE-2026-6741

LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID Medium

April 16, 2026 Patched in ["5.4.0"] CVE-2026-5234

LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

April 7, 2026 Patched in ["5.3.1"] CVE-2026-4785

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

March 23, 2026 Patched in ["5.2.7"] CVE-2026-32533

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting Medium

March 10, 2026 Patched in ["5.2.8"] CVE-2026-2324

LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import Medium

March 2, 2026 Patched in ["5.2.8"] CVE-2026-1487

LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation High

March 2, 2026 Patched in ["5.2.8"] CVE-2026-1566

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery Medium

February 13, 2026 Patched in ["5.2.6"] CVE-2025-14873

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure Medium

February 11, 2026 Patched in ["5.2.7"] CVE-2026-1537

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting High

February 2, 2026 Patched in ["5.2.6"] CVE-2026-0617

LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

September 29, 2025 Patched in ["5.2.0"] CVE-2025-6941

LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function High

September 29, 2025 Patched in ["5.2.0"] CVE-2025-7038

LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function High

September 29, 2025 Patched in ["5.2.0"] CVE-2025-7052

LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

September 29, 2025 Patched in ["5.2.0"] CVE-2025-6815

LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion Critical

July 23, 2025 Patched in ["5.1.94"] CVE-2025-6715

Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference Medium

May 13, 2025 Patched in ["5.1.93"] CVE-2025-3769

LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

March 27, 2025 Patched in ["5.1.7"] CVE-2025-30836

LatePoint <= 5.0.12 - Authentication Bypass Critical

September 24, 2024 Patched in ["5.0.13"] CVE-2024-8943

LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection Critical

September 20, 2024 Patched in ["5.0.12"] CVE-2024-8911

LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

August 29, 2024 Patched in [] CVE-2024-43992

LatePoint <= 4.9.91 - Cross-Site Request Forgery Medium

August 26, 2024 Patched in [] CVE-2024-43945

LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR Critical

June 13, 2024 Patched in ["4.9.9.1"] CVE-2024-2472

What It Does

LatePoint is an appointment booking plugin that lets visitors self-schedule services from your WordPress site around the clock. It handles the full booking workflow, including agent assignment, service selection, reminders, and payment collection at the time of booking. Built-in tools target no-show reduction through automated notifications and confirmations.

Who It's For

LatePoint suits small to mid-sized service businesses, such as salons, clinics, consultants, and tutors, that need a polished self-service booking flow without a third-party SaaS dependency. It is a strong fit for site owners comfortable configuring services, agents, and availability rules directly in WordPress. Businesses with simple scheduling needs will find the feature set more than adequate.

Who Should Skip It

If you only need a static availability calendar or a basic contact form, LatePoint is overkill. Very large enterprises with multi-branch, multi-tenant scheduling requirements may find its scope limiting compared to dedicated platforms.

The Bottom Line

LatePoint earns an overall quality score of 84.59 out of 100, combining high user satisfaction, active maintenance, and broad compatibility into one of the strongest appointment plugins in the category. The only meaningful caution is the thin public support history, which makes long-term vendor responsiveness harder to judge. For most service-based businesses wanting a self-hosted booking system, it is a confident recommendation.

Pick this if you want a lighter, more general-purpose booking flow with strong WooCommerce integration and less configuration overhead.

Booking for Appointments and Events Calendar – Amelia 83/100

Pick Amelia if you need richer front-end dashboards, customer accounts, and event-style group bookings out of the box.

Booking Calendar 83/100

Pick Booking Calendar if you need the most basic day-by-day reservation grid with minimal configuration.

Online Scheduling and Appointment Booking System – Bookly 82/100

Pick Bookly if you want a more modular paid addon ecosystem for SMS, voice, and marketing extensions.

SimplyBook.me – Booking and reservations calendar 81/100

Pick SimplyBook.me if you prefer a hybrid SaaS plus WordPress widget model rather than a fully self-hosted booking system.