Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 68% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

16 of the last 26 four- and five-star reviews came from accounts created within a month of posting the review, and 6 of those landed between 2026-03-28 and 2026-04-23.

Registering a wp.org account just to leave a review is common and often entirely legitimate. The share here is unusually high for the sample, so it's worth keeping in mind while reading the reviews.

1. ★★★★★ shantohealing

   1mo ago

   I have never had such a support like this. Very to the point and exactly what I needed to know. After sending a pdf with the question and solution as a gesture of gratitude, latepoint is willing to implement this in the documentation. This will help all others in the future.

   Read on wp.org ↗
2. ★★★★★ roanne

   2mo ago

   Fast and effective support

   Read on wp.org ↗
3. ★★★★★ pmcotroneo

   2mo ago

   Excellent plugin ! Nous l’utilisons pour la gestion des réservations de la grue de levage, des bateaux et du club house de notre club nautique. La configuration prend du temps mais le résultat très satisfaisant. L’interface utilisateur est simple pour les clients. Nous utilisons Latepoint en complément du plugin Ultimate Members afin de gérer les comptes des clients. Les deux plugins fonctionnent bien ensemble. Il reste toutefois quelques bugs à corriger par exemple dans le menu “Calendrier”: l’affichage est incohérent lorsqu’on filtre les réservations.

   Read on wp.org ↗
4. ★★★★★ laurie22

   2mo ago

   Tres bonne application !

   Read on wp.org ↗
5. ★★★★★ abrahamben99

   2mo ago

   plugin settings are easy to understand , I am happy with the plugin and support.

   Read on wp.org ↗
6. ★★★★★ remigouzy

   3mo ago

   Thanks to the LatePoint team who were very responsive and met my needs. I highly recommend their LatePoint tool; it’s very effective and customizable!

   Read on wp.org ↗
7. ★★★★★ shane9779

   3mo ago

   Over the past few months plugin has many improvements and superb support, great job

   Read on wp.org ↗
8. ★★★★★ bridget0701

   3mo ago

   I faced issues with stripe integration but their support is excellent it works now 👍

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 5.6.9 New Introduces the PayPal v6 payment gateway integration. Improvements Added filter ‘latepoint_calendar_now_datetime’ for calendar flexibility to better support customer timezone-based calendars. Reordered the Permitted 5.6.9
2. — Version 5.6.8 New Added MCP server support with the /wp-json/latepoint/v1/mcp endpoint, AI client integration (such as Claude), and a settings panel for easy setup. Requires WordPress 6.9+ and the MCP Adapter plugin. Added support for 5.6.8
3. — Version 5.6.7 Fixes Fixed a “You have to select an agent” error that occurred when choosing “Any agent.” Security Addressed security bugs. Props to Khoa and WordFence for reporting it. 5.6.7
4. — Version 5.6.6 Fixes Fixed an inconsistent slots availability in the dashboard calendar view despite being unavailable in availability and booking interfaces. 5.6.6
5. — Version 5.6.5 New Added maximum bookings per day feature support for an upcoming premium release, allowing you to set limits on the number of bookings a customer can make per day. Added cancellation and reschedule reason feature featu 5.6.5
6. — Version 5.6.4 Security Addressed security bugs. Props to WordFence for reporting it. Addressed security bugs. Props to Patchstack for reporting it. 5.6.4

38 disclosed vulnerabilities on record for this plugin, 2 still affect the current version.

1. Medium · 6.4 LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
   2026-08-05 CVE-2026-5391 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.3.2 Patched in 5.4.0
2. Medium · 5.3 LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment ↗
   2026-07-10 CVE-2026-15250 Missing Authorization Affects <= 5.6.7 Patched in 5.6.8
3. High · 7.5 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection ↗
   2026-07-08 CVE-2026-57714 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.6.3 Patched in 5.6.4
4. High · 7.5 LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass ↗
   2026-07-07 CVE-2026-5356 Missing Authorization Affects <= 5.4.0 Patched in 5.4.1
5. Medium · 5.3 LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step ↗
   2026-07-02 CVE-2026-11398 Missing Authorization Affects <= 5.6.1 Patched in 5.6.2
6. Medium · 5.3 LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter ↗
   2026-07-01 CVE-2026-12657 Authorization Bypass Through User-Controlled Key Affects <= 5.6.2 Patched in 5.6.3
7. High · 8.8 LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter ↗
   2026-06-30 CVE-2026-13228 Improper Privilege Management Affects <= 5.6.3 Patched in 5.6.4
8. Medium · 4.3 LatePoint <= 5.6.2 - Cross-Site Request Forgery ↗
   2026-06-25 CVE-2026-11866 Cross-Site Request Forgery (CSRF) Affects <= 5.6.2 Patched in 5.6.3
9. High · 7.5 LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset ↗
   2026-06-15 CVE-2026-8176 Improper Privilege Management Affects <= 5.5.1 Patched in 5.5.2
10. Medium · 4.3 LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action ↗
    2026-06-05 CVE-2026-9719 Cross-Site Request Forgery (CSRF) Affects <= 5.6.0 Patched in 5.6.1
11. High · 8.8 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation ↗
    2026-06-05 CVE-2026-49083 Incorrect Privilege Assignment Affects <= 5.5.1 Patched in 5.5.2
12. Medium · 4.3 LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route ↗
    2026-05-13 CVE-2026-5365 Cross-Site Request Forgery (CSRF) Affects <= 5.3.2 Patched in 5.4.0
13. Medium · 5.3 LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism ↗
    2026-05-08 CVE-2026-7652 Weak Password Recovery Mechanism for Forgotten Password Affects <= 5.5.0 Patched in 5.5.1
14. High · 7.2 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-05-06 CVE-2026-7448 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.0 Patched in 5.5.1
15. High · 7.2 LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter ↗
    2026-05-05 CVE-2026-7332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.0 Patched in 5.5.1
16. Medium · 6.4 LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update ↗
    2026-05-05 CVE-2026-7457 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.0 Patched in 5.5.1
17. High · 8.8 LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability ↗
    2026-04-27 CVE-2026-6741 Improper Privilege Management Affects <= 5.4.1 Patched in 5.4.2
18. Medium · 5.3 LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID ↗
    2026-04-16 CVE-2026-5234 Authorization Bypass Through User-Controlled Key Affects <= 5.3.2 Patched in 5.4.0
19. Medium · 6.4 LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2026-04-07 CVE-2026-4785 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.3.0 Patched in 5.3.1
20. Medium · 4.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-03-23 CVE-2026-32533 Authorization Bypass Through User-Controlled Key Affects <= 5.2.6 Patched in 5.2.7
21. Medium · 6.1 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting ↗
    2026-03-10 CVE-2026-2324 Cross-Site Request Forgery (CSRF) Affects <= 5.2.7 Patched in 5.2.8
22. Medium · 6.5 LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import ↗
    2026-03-02 CVE-2026-1487 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.2.7 Patched in 5.2.8
23. High · 8.8 LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation ↗
    2026-03-02 CVE-2026-1566 Improper Privilege Management Affects <= 5.2.7 Patched in 5.2.8
24. Medium · 4.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery ↗
    2026-02-13 CVE-2025-14873 Cross-Site Request Forgery (CSRF) Affects <= 5.2.5 Patched in 5.2.6
25. Medium · 5.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure ↗
    2026-02-11 CVE-2026-1537 Missing Authorization Affects <= 5.2.6 Patched in 5.2.7
26. High · 7.2 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-02-02 CVE-2026-0617 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.5 Patched in 5.2.6
27. Medium · 6.4 LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2025-09-29 CVE-2025-6941 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.94 Patched in 5.2.0
28. High · 8.2 LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function ↗
    2025-09-29 CVE-2025-7038 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.1.94 Patched in 5.2.0
29. High · 8.8 LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function ↗
    2025-09-29 CVE-2025-7052 Cross-Site Request Forgery (CSRF) Affects <= 5.1.94 Patched in 5.2.0
30. Medium · 5.5 LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-09-29 CVE-2025-6815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.94 Patched in 5.2.0
31. Critical · 9.8 LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion ↗
    2025-07-23 CVE-2025-6715 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 5.1.93 Patched in 5.1.94
32. Medium · 5.3 Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference ↗
    2025-05-13 CVE-2025-3769 Authorization Bypass Through User-Controlled Key Affects <= 5.1.92 Patched in 5.1.93
33. Medium · 6.4 LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-03-27 CVE-2025-30836 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.6 Patched in 5.1.7
34. Critical · 9.8 LatePoint <= 5.0.12 - Authentication Bypass ↗
    2024-09-24 CVE-2024-8943 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.0.12 Patched in 5.0.13
35. Critical · 9.8 LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection ↗
    2024-09-20 CVE-2024-8911 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.0.11 Patched in 5.0.12
36. Medium · 6.4 LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-08-29 CVE-2024-43992 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.91 No patch available
37. Medium · 4.3 LatePoint <= 4.9.91 - Cross-Site Request Forgery ↗
    2024-08-26 CVE-2024-43945 Cross-Site Request Forgery (CSRF) Affects <= 4.9.91 No patch available
38. Critical · 9.1 LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR ↗
    2024-06-13 CVE-2024-2472 Authorization Bypass Through User-Controlled Key Affects <= 4.9.9 Patched in 4.9.9.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 11 languages, 2 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-09-15 90K+ → 100K+ up after 20 days in tier
2. 2025-08-26 80K+ → 90K+ up after 20 days in tier
3. 2025-08-06 70K+ → 80K+ up after 24 days in tier
4. 2025-07-13 60K+ → 70K+ up after 25 days in tier
5. 2025-06-18 50K+ → 60K+ up after 20 days in tier
6. 2025-05-29 40K+ → 50K+ up after 19 days in tier
7. 2025-05-10 30K+ → 40K+ up after 17 days in tier
8. 2025-04-23 20K+ → 30K+ up after 16 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Simply Schedule Appointments 50K+ installs · 4.9★ · 5 shared tags A
• Advanced Appointment Booking & Scheduling 3K+ installs · 3.6★ · 5 shared tags B
• Bookify – Appointment Booking & Scheduling for WordPress 10+ installs · 3.6★ · 5 shared tags B
• Online Scheduling and Appointment Booking System – Bookly 60K+ installs · 4.4★ · 4 shared tags A
• Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution 20K+ installs · 4.5★ · 4 shared tags A
• WPS Bookings for WooCommerce 3K+ installs · 4.3★ · 4 shared tags A

Embed this report card

Drop a live Pulse card for Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress into a readme, a review or a deck. It updates itself.

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: 100K+ active installs, 4.9★ (98 reviews). Plugin Pulse (WP Mayor), as of 2026-08-26. https://plugins.wpmayor.com/plugin/latepoint