Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

440 searches this plugin appeared in over the last 90 days, 20 listed. 356 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 14 months ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

16 of the last 26 four- and five-star reviews came from accounts created within a month of posting the review, and 6 of those landed between 2026-03-28 and 2026-04-23.

Registering a wp.org account just to leave a review is common and often entirely legitimate. The share here is unusually high for the sample, so it's worth keeping in mind while reading the reviews.

1. ★★★★★ shantohealing

   4mo ago

   I have never had such a support like this. Very to the point and exactly what I needed to know. After sending a pdf with the question and solution as a gesture of gratitude, latepoint is willing to implement this in the documentation. This will help all others in the future.

   Read on wp.org ↗
2. ★★★★★ roanne

   4mo ago

   Fast and effective support

   Read on wp.org ↗
3. ★★★★★ pmcotroneo

   4mo ago

   Excellent plugin ! Nous l’utilisons pour la gestion des réservations de la grue de levage, des bateaux et du club house de notre club nautique. La configuration prend du temps mais le résultat très satisfaisant. L’interface utilisateur est simple pour les clients. Nous utilisons Latepoint en complément du plugin Ultimate Members afin de gérer les comptes des clients. Les deux plugins fonctionnent bien ensemble. Il reste toutefois quelques bugs à corriger par exemple dans le menu “Calendrier”: l’affichage est incohérent lorsqu’on filtre les réservations.

   Read on wp.org ↗
4. ★★★★★ laurie22

   5mo ago

   Tres bonne application !

   Read on wp.org ↗
5. ★★★★★ abrahamben99

   5mo ago

   plugin settings are easy to understand , I am happy with the plugin and support.

   Read on wp.org ↗
6. ★★★★★ remigouzy

   5mo ago

   Thanks to the LatePoint team who were very responsive and met my needs. I highly recommend their LatePoint tool; it’s very effective and customizable!

   Read on wp.org ↗
7. ★★★★★ shane9779

   5mo ago

   Over the past few months plugin has many improvements and superb support, great job

   Read on wp.org ↗
8. ★★★★★ bridget0701

   6mo ago

   I faced issues with stripe integration but their support is excellent it works now 👍

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 5.6.9 New Introduces the PayPal v6 payment gateway integration. Improvements Added filter ‘latepoint_calendar_now_datetime’ for calendar flexibility to better support customer timezone-based calendars. Reordered the Permitted 5.6.9
2. — Version 5.6.8 New Added MCP server support with the /wp-json/latepoint/v1/mcp endpoint, AI client integration (such as Claude), and a settings panel for easy setup. Requires WordPress 6.9+ and the MCP Adapter plugin. Added support for 5.6.8
3. — Version 5.6.7 Fixes Fixed a “You have to select an agent” error that occurred when choosing “Any agent.” Security Addressed security bugs. Props to Khoa and WordFence for reporting it. 5.6.7
4. — Version 5.6.6 Fixes Fixed an inconsistent slots availability in the dashboard calendar view despite being unavailable in availability and booking interfaces. 5.6.6
5. — Version 5.6.5 New Added maximum bookings per day feature support for an upcoming premium release, allowing you to set limits on the number of bookings a customer can make per day. Added cancellation and reschedule reason feature featu 5.6.5
6. — Version 5.6.4 Security Addressed security bugs. Props to WordFence for reporting it. Addressed security bugs. Props to Patchstack for reporting it. 5.6.4

2 open vulnerabilities affect the current version (5.7.6). 54 of 56 disclosed are patched.

1. Patched Medium · 5.3 LatePoint <= 5.7.4 - Unauthenticated Payment Bypass ↗
   2026-10-19 CVE-2026-105256 Client-Side Enforcement of Server-Side Security Affects <= 5.7.4 Patched in 5.7.5
2. Patched Medium · 4.3 LatePoint <= 5.7.4 - Authenticated (Agent+) Insecure Direct Object Reference ↗
   2026-10-19 CVE-2026-105257 Authorization Bypass Through User-Controlled Key Affects <= 5.7.4 Patched in 5.7.5
3. Patched Low · 3.7 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter ↗
   2026-10-16 CVE-2026-111602 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.7.4 Patched in 5.7.5
4. Patched Critical · 9.1 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter ↗
   2026-10-16 CVE-2026-110653 Improper Authentication Affects <= 5.7.4 Patched in 5.7.5
5. Patched High · 7.4 Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback ↗
   2026-10-13 CVE-2026-100163 Improper Authentication Affects <= 5.7.2 Patched in 5.7.3
6. Patched High · 7.5 Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters ↗
   2026-10-13 CVE-2026-103366 Authorization Bypass Through User-Controlled Key Affects <= 5.7.3 Patched in 5.7.4
7. Patched Medium · 4.3 Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion ↗
   2026-10-13 CVE-2026-103380 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.7.3 Patched in 5.7.4
8. Patched High · 7.5 Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter ↗
   2026-10-09 CVE-2026-96662 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.7.2 Patched in 5.7.3
9. Patched High · 8.8 Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter ↗
   2026-10-09 CVE-2026-104766 Improper Privilege Management Affects <= 5.7.3 Patched in 5.7.4
10. Patched Medium · 4.3 Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter ↗
    2026-10-09 CVE-2026-91050 Authorization Bypass Through User-Controlled Key Affects <= 5.7.2 Patched in 5.7.3
11. Patched Medium · 4.3 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference ↗
    2026-10-08 CVE-2026-105197 Authorization Bypass Through User-Controlled Key Affects < 5.6.5 Patched in 5.6.5
12. Patched Medium · 4.3 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference ↗
    2026-10-08 CVE-2026-105196 Authorization Bypass Through User-Controlled Key Affects < 5.6.9 Patched in 5.6.9
13. Patched Medium · 5.3 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference ↗
    2026-10-08 CVE-2026-105198 Authorization Bypass Through User-Controlled Key Affects < 5.7.3 Patched in 5.7.3
14. Patched Medium · 5.4 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification ↗
    2026-10-07 CVE-2026-17538 Authorization Bypass Through User-Controlled Key Affects <= 5.6.9 Patched in 5.6.10
15. Patched Medium · 5.3 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter ↗
    2026-10-01 CVE-2026-94432 Authorization Bypass Through User-Controlled Key Affects <= 5.7.1 Patched in 5.7.2
16. Patched Critical · 9.1 Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field ↗
    2026-09-30 CVE-2026-92966 Improper Control of Generation of Code Affects <= 5.7.0 Patched in 5.7.1
17. Patched Medium · 4.3 LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) ↗
    2026-09-17 CVE-2026-13471 Authorization Bypass Through User-Controlled Key Affects <= 5.6.3 Patched in 5.6.4
18. Patched Medium · 4.3 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter ↗
    2026-09-17 CVE-2026-18441 Authorization Bypass Through User-Controlled Key Affects <= 5.6.9 Patched in 5.6.10
19. Patched Medium · 6.4 LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
    2026-08-05 CVE-2026-5391 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.2 Patched in 5.4.0
20. Patched Medium · 5.3 LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment ↗
    2026-07-10 CVE-2026-15250 Missing Authorization Affects <= 5.6.7 Patched in 5.6.8
21. Patched High · 7.5 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection ↗
    2026-07-08 CVE-2026-57714 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.6.3 Patched in 5.6.4
22. Patched High · 7.5 LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass ↗
    2026-07-07 CVE-2026-5356 Missing Authorization Affects <= 5.4.0 Patched in 5.4.1
23. Patched Medium · 5.3 LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step ↗
    2026-07-02 CVE-2026-11398 Missing Authorization Affects <= 5.6.1 Patched in 5.6.2
24. Patched Medium · 5.3 LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter ↗
    2026-07-01 CVE-2026-12657 Authorization Bypass Through User-Controlled Key Affects <= 5.6.2 Patched in 5.6.3
25. Patched High · 8.8 LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter ↗
    2026-06-30 CVE-2026-13228 Improper Privilege Management Affects <= 5.6.3 Patched in 5.6.4
26. Patched Medium · 4.3 LatePoint <= 5.6.2 - Cross-Site Request Forgery ↗
    2026-06-25 CVE-2026-11866 Cross-Site Request Forgery Affects <= 5.6.2 Patched in 5.6.3
27. Patched High · 7.5 LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset ↗
    2026-06-15 CVE-2026-8176 Improper Privilege Management Affects <= 5.5.1 Patched in 5.5.2
28. Patched Medium · 4.3 LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action ↗
    2026-06-05 CVE-2026-9719 Cross-Site Request Forgery Affects <= 5.6.0 Patched in 5.6.1
29. Patched High · 8.8 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation ↗
    2026-06-05 CVE-2026-49083 Incorrect Privilege Assignment Affects <= 5.5.1 Patched in 5.5.2
30. Patched Medium · 4.3 LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route ↗
    2026-05-13 CVE-2026-5365 Cross-Site Request Forgery Affects <= 5.3.2 Patched in 5.4.0
31. Patched Medium · 5.3 LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism ↗
    2026-05-08 CVE-2026-7652 Weak Password Recovery Mechanism for Forgotten Password Affects <= 5.5.0 Patched in 5.5.1
32. Patched High · 7.2 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-05-06 CVE-2026-7448 Improper Neutralization of Input During Web Page Generation Affects <= 5.5.0 Patched in 5.5.1
33. Patched High · 7.2 LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter ↗
    2026-05-05 CVE-2026-7332 Improper Neutralization of Input During Web Page Generation Affects <= 5.5.0 Patched in 5.5.1
34. Patched Medium · 6.4 LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update ↗
    2026-05-05 CVE-2026-7457 Improper Neutralization of Input During Web Page Generation Affects <= 5.5.0 Patched in 5.5.1
35. Patched High · 8.8 LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability ↗
    2026-04-27 CVE-2026-6741 Improper Privilege Management Affects <= 5.4.1 Patched in 5.4.2
36. Patched Medium · 5.3 LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID ↗
    2026-04-16 CVE-2026-5234 Authorization Bypass Through User-Controlled Key Affects <= 5.3.2 Patched in 5.4.0
37. Patched Medium · 6.4 LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2026-04-07 CVE-2026-4785 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.0 Patched in 5.3.1
38. Patched Medium · 4.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-03-23 CVE-2026-32533 Authorization Bypass Through User-Controlled Key Affects <= 5.2.6 Patched in 5.2.7
39. Patched Medium · 6.1 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting ↗
    2026-03-10 CVE-2026-2324 Cross-Site Request Forgery Affects <= 5.2.7 Patched in 5.2.8
40. Patched Medium · 6.5 LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import ↗
    2026-03-02 CVE-2026-1487 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.2.7 Patched in 5.2.8
41. Patched High · 8.8 LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation ↗
    2026-03-02 CVE-2026-1566 Improper Privilege Management Affects <= 5.2.7 Patched in 5.2.8
42. Patched Medium · 4.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery ↗
    2026-02-13 CVE-2025-14873 Cross-Site Request Forgery Affects <= 5.2.5 Patched in 5.2.6
43. Patched Medium · 5.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure ↗
    2026-02-11 CVE-2026-1537 Missing Authorization Affects <= 5.2.6 Patched in 5.2.7
44. Patched High · 7.2 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-02-02 CVE-2026-0617 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.5 Patched in 5.2.6
45. Patched Medium · 6.4 LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2025-09-29 CVE-2025-6941 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.94 Patched in 5.2.0
46. Patched High · 8.2 LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function ↗
    2025-09-29 CVE-2025-7038 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.1.94 Patched in 5.2.0
47. Patched High · 8.8 LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function ↗
    2025-09-29 CVE-2025-7052 Cross-Site Request Forgery Affects <= 5.1.94 Patched in 5.2.0
48. Patched Medium · 5.5 LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-09-29 CVE-2025-6815 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.94 Patched in 5.2.0
49. Patched Critical · 9.8 LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion ↗
    2025-07-23 CVE-2025-6715 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 5.1.93 Patched in 5.1.94
50. Patched Medium · 5.3 Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference ↗
    2025-05-13 CVE-2025-3769 Authorization Bypass Through User-Controlled Key Affects <= 5.1.92 Patched in 5.1.93
51. Patched Medium · 6.4 LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-03-27 CVE-2025-30836 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.6 Patched in 5.1.7
52. Patched Critical · 9.8 LatePoint <= 5.0.12 - Authentication Bypass ↗
    2024-09-24 CVE-2024-8943 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.0.12 Patched in 5.0.13
53. Patched Critical · 9.8 LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection ↗
    2024-09-20 CVE-2024-8911 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.0.11 Patched in 5.0.12
54. Open Medium · 6.4 LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-08-29 CVE-2024-43992 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.91 No patch available
55. Open Medium · 4.3 LatePoint <= 4.9.91 - Cross-Site Request Forgery ↗
    2024-08-26 CVE-2024-43945 Cross-Site Request Forgery Affects <= 4.9.91 No patch available
56. Patched Critical · 9.1 LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR ↗
    2024-06-13 CVE-2024-2472 Authorization Bypass Through User-Controlled Key Affects <= 4.9.9 Patched in 4.9.9.1

Translated into 13 languages, 4 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-09-15 90K+ → 100K+ up after 20 days in tier
2. 2025-08-26 80K+ → 90K+ up after 20 days in tier
3. 2025-08-06 70K+ → 80K+ up after 24 days in tier
4. 2025-07-13 60K+ → 70K+ up after 25 days in tier
5. 2025-06-18 50K+ → 60K+ up after 20 days in tier
6. 2025-05-29 40K+ → 50K+ up after 19 days in tier
7. 2025-05-10 30K+ → 40K+ up after 17 days in tier
8. 2025-04-23 20K+ → 30K+ up after 16 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress into a readme, a review or a deck. It updates itself.

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: 100K+ active installs, 4.9★ (107 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/latepoint