Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Explore Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities across all versions. Currently tracking 35 known vulnerabilities, including severity, impact, and patch status.

01234567891029.01.2025Today13.06.20249.1LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR CVSS 9.1 · 13.06.202426.08.20244.3LatePoint <= 4.9.91 - Cross-Site Request Forgery CVSS 4.3 · 26.08.202429.08.20246.4LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 29.08.202420.09.20249.8LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection CVSS 9.8 · 20.09.202424.09.20249.8LatePoint <= 5.0.12 - Authentication Bypass CVSS 9.8 · 24.09.202427.03.20256.4LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 27.03.202513.05.20255.3Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference CVSS 5.3 · 13.05.202523.07.20259.8LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion CVSS 9.8 · 23.07.202529.09.20258.2LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function CVSS 8.2 · 29.09.20258.8LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function CVSS 8.8 · 29.09.20256.4LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 29.09.20255.5LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 5.5 · 29.09.202502.02.20267.2LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 02.02.202611.02.20265.3LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure CVSS 5.3 · 11.02.202613.02.20264.3LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery CVSS 4.3 · 13.02.202602.03.20268.8LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation CVSS 8.8 · 02.03.20266.5LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import CVSS 6.5 · 02.03.202610.03.20266.1LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting CVSS 6.1 · 10.03.202623.03.20264.3LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 23.03.202607.04.20266.4LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 07.04.202616.04.20265.3LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID CVSS 5.3 · 16.04.202627.04.20268.8LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability CVSS 8.8 · 27.04.202605.05.20266.4LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update CVSS 6.4 · 05.05.20267.2LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter CVSS 7.2 · 05.05.202606.05.20267.2LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 06.05.202608.05.20265.3LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism CVSS 5.3 · 08.05.202613.05.20264.3LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route CVSS 4.3 · 13.05.202605.06.20268.8LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation CVSS 8.8 · 05.06.20264.3LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action CVSS 4.3 · 05.06.202615.06.20267.5LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset CVSS 7.5 · 15.06.202630.06.20268.8LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter CVSS 8.8 · 30.06.202601.07.20265.3LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter CVSS 5.3 · 01.07.202602.07.20265.3LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step CVSS 5.3 · 02.07.202607.07.20267.5LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass CVSS 7.5 · 07.07.202608.07.20267.5Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection CVSS 7.5 · 08.07.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage94%
Open

2

Fixed

33

Get automatic notifications for all Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities before they are exploited.

Vulnerability Records

35 records
2026-07-08 00:00CVE-2026-57714
7.5
High
darooYes
2026-07-07 23:37CVE-2026-5356
7.5
High
Andrés CrucianiYes
2026-07-02 19:22CVE-2026-11398
5.3
Medium
hhhaiYes
2026-07-01 20:02CVE-2026-12657
5.3
Medium
gidget smithYes
2026-06-30 21:30CVE-2026-13228
8.8
High
d.v4n_s3cYes
2026-06-15 20:57CVE-2026-8176
7.5
High
d.v4n_s3cYes
2026-06-05 11:05CVE-2026-9719
4.3
Medium
alex_henry20Yes
2026-06-05 00:00CVE-2026-49083
8.8
High
VanTasticYes
2026-05-13 17:41CVE-2026-5365
4.3
Medium
TulgaaaaYes
2026-05-08 14:16CVE-2026-7652
5.3
Medium
Michael Iden (Mickhat)Yes
Showing 1–10 of 35 reports
Appointment Booking Plugin – LatePoint | Calendar &amp; Scheduling for WordPress banner
Latestv5.6.9

Appointment Booking Plugin – LatePoint | Calendar &amp; Scheduling for WordPress

LatePoint

Author

LatePoint

4.9(93)
98/100
Last Updated
2026-07-19 (11d ago)
Active Installs
100,000+
Downloads
1,422,247
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2025-01-29 (2y ago)

LatePoint – The Lightweight Appointment Booking Plugin for WordPress ★★★★★ LatePoint is the appointment booking plugin for WordPress that lets your clients schedule, reschedule, and pay for appointments without a single back-and-forth email. Used on 100,000+ WordPress sites, LatePoint gives service businesses a fully branded booking experience that works 24/7. Your clients book from any device. You get paid upfront. No-shows drop. Admin time disappears. Whether you’re a coach, salon, consultant, or clinic, if your business runs on bookings, LatePoint makes it easy to manage your schedule, take payments, and let clients book online 24/7. Set it up in 10 minutes. Look professional. Automate the boring stuff. Let LatePoint handle the heavy lifting so you can focus on your business. Try the Live Demo Features available with the free plugin Booking & scheduling Unlimited appointments Multi-step booking form & step-by-step wizard Instant booking forms Booking form customization Custom schedules, holidays & days off Time restrictions & timeslot logic Cancellation Clone service Payments Stripe payments Razorpay payments Manual payments (Pay Later) Notifications Email notifications Management & admin Single location Customer dashboard Admin analytics dashboard Activity log Scheduled jobs Conversion tracking through tracking code configuration Import / export functionality Features available with LatePoint Pro Booking & scheduling Multiple locations & multi-location management Multiple staff & agents Recurring appointments Group bookings Custom service durations Service categories Service extras / add-ons Service packages Quick time blocking Shopping cart (book multiple appointments at once) Rescheduling Payments PayPal, Square, Mollie, MercadoPago, Flutterwave, Braintree, PayStack, SureCart WooCommerce integration Local payment (pay later) Pay via a link Refund processing Invoices Tax support Notifications SMS notifications WhatsApp notifications Email & SMS scheduled notifications Reminder notifications Integrations Google Calendar sync Zoom, Google Meet, and Microsoft Teams integration Mailchimp integration Webhook functionality Forms & customization Custom fields for booking forms Address autocomplete Custom roles (e.g. Manager) Security & spam protection Agent dashboard See the Full Free vs Pro Feature Comparison Accept payments at the time of booking LatePoint lets you collect payment the moment a client books, no due invoices, no chasing, no unpaid appointments. Connect Stripe or Razorpay in about 10 minutes and start accepting payments on the free plan. Choose how you get paid: Full payment at booking: Client pays the complete service fee upfront Deposit at booking: collect a fixed amount or percentage to hold the slot, balance due later Pay later: Send a payment link after the appointment via the invoicing feature Payments are processed directly by your payment gateway. LatePoint never holds your funds. Card data is handled entirely by Stripe or your chosen processor. PCI-DSS compliant by default. Accept payments with Razorpay | Accept payments with Stripe Why accept payments at the time of booking? Accepting a deposit is the single most effective way to reduce no-shows. When a client has paid to hold their slot, they show up. LatePoint makes it a one-step process at checkout. Supported payment gateways (free plugin): Stripe and Razorpay Supported payment gateways (Pro): PayPal, Square, Mollie, MercadoPago, Flutterwave, Braintree, PayStack, WooCommerce Payments, Stripe, and Razorpay Who Is LatePoint For? LatePoint is built for small businesses and independent professionals who run on appointments. Whether you’re a solo practitioner or managing a small team, if your business depends on clients booking time with you, LatePoint saves you the back-and-forth and gets you paid faster. Salons & Studios If you run a personal care studio, hair or nail salon, spa, massage therapist or tattoo studio, you’ll know how important it is to avoid no-shows, double-bookings, and awkward payment moments. With LatePoint: Customers can book online anytime You can send automatic reminders so clients actually show up Accept payments upfront or after the session Sync your bookings with Google Calendar ▶️ How To Set Up LatePoint for Salons Coaches, Consultants & Trainers If you run 1:1 sessions, group coaching, or online workshops, LatePoint keeps your schedule organized and sessions full. Let clients pick time slots based on availability Accept payments or deposits at the time of booking Offer in-person or Zoom sessions Sell service packages and recurring appointments How to Setup LatePoint for Consultants Clinics, Therapists & Healthcare Pros For medical, wellness, or therapy practices, LatePoint helps you stay professional while giving patients a smooth experience. Collect patient information with custom fields Offer multiple services with different specialists Manage multiple staff calendars and locations Education & Classes Whether you’re a tutor, language teacher, or run in-person classes, you can: Let students book 1:1 or group sessions Handles sessions with upfront payment so you’re never chasing payments post classes Limit bookings to your preferred hours Automate reminders and payments How to Setup LatePoint for Private Tutors Local Services & Agencies Photographers, cleaners, auto services, pet services, repair shops, if your business depends on appointments, LatePoint makes it simple. Show real-time availability Set different schedules by service or team member Let clients book 24/7, no calls or emails needed Tours, Rentals & Experiences If you run a jet ski rental, dive school, boat tour, or any activity business, LatePoint handles slot-based bookings with upfront payment so you’re never chasing deposits last minute. Let customers book specific time slots for activities or guided sessions Require full payment or a deposit at booking to confirm the reservation Send automatic reminders so customers show up prepared Set capacity limits per session for group tours Legal & Law Firms If you run a law firm, notary practice, or offer legal consultations, LatePoint helps you manage client appointments professionally without the back-and-forth. Let clients book consultations directly from your website Collect intake information upfront with custom booking fields Send automatic reminders to reduce missed appointments Manage schedules across multiple attorneys or staff members Pet Services Whether you run a grooming salon, doggy daycare, or mobile pet care service, LatePoint keeps your bookings organised and your clients coming back. Let pet owners book appointments online anytime Accept payments or deposits at the time of booking Set different availability for different services or staff Send reminders so clients never miss a grooming slot HVAC & Home Services For HVAC technicians, plumbers, electricians, and other trade businesses, LatePoint makes it easy for customers to book service visits without a phone call. Let customers request appointments directly from your website Set availability by service type or team member Send automatic confirmations and reminders before the visit Manage jobs across multiple technicians from one dashboard What Makes LatePoint Unique? LatePoint isn’t just another booking plugin, it’s designed to solve real-world scheduling problems with a smart, flexible approach. Purpose-built for service providers: From solo pros to teams across locations, LatePoint adapts to your business. Quick to launch, simple to manage: The built-in onboarding wizard walks you through the entire setup. You’ll go from install to taking bookings in under 10 minutes. Mobile-first booking experience: Clients see clean, intuitive forms that work beautifully on phones, tablets, and desktops. Fewer clicks = fewer drop-offs. Automation built-in: LatePoint handles confirmations, reminders, follow-ups, and payments. Skip the admin and focus on delivering your services. Affordable, with a forever-free plan: You won’t get trapped in expensive subscriptions. Start with the free version, and upgrade when you need advanced features. Native to WordPress: Built to feel like a natural part of your site, LatePoint works with most popular themes and page builders out of the box. LatePoint Review: Is It the Right Booking Plugin for Your Service? How It Works Install the plugin: Download LatePoint from the WordPress plugin repository and activate it on your site. Complete the setup wizard: Walk through a simple onboarding process to set your services and availability. Customize your booking form: Add fields to collect the information you need before a session. Choose which details to make required or optional. Add booking to your site: Use a shortcode or LatePoint widget to place the booking interface into any page or post. Start accepting bookings: Customers can now see your real-time availability, book appointments, pay, and receive confirmation emails. Manage everything in your dashboard: View and manage appointments, customer information, payments, and notifications directly from your agent dashboard. Customer dashboard: Let customers manage their appointments through a dedicated customer dashboard. Follow the Step-by-Step Guide Features You’ll Love With the Plugin ✅ Appointment booking form builder – Build the form customers will fill while scheduling their appointments. ✅ Stripe and Razorpay payments at booking – Accept a deposit the moment a client books. ✅ Admin dashboard – Full calendar view with filters for appointments and services. ✅ Multi-step booking wizard – A clean, guided booking flow that works on any device without configuration. ✅ Email notifications – Automatic confirmations sent to both you and your client at booking. ✅ Cancellation management – Let clients cancel their own appointments without emailing you. ✅ Custom schedules & holidays – Set your working hours, block off days, and manage time off without workarounds. ✅ Conversion tracking – Track how many visitors turn into bookings by configuring third-party tracking code. ✅ Import / export – Move your data in and out without needing a developer. ✅ Activity log – See a full history of every action taken on your account. Want To Unlock More? LatePoint’s free plugin is a solid starting point – unlimited appointments, Stripe & Razorpay payments, and a full booking experience out of the box. When your business grows and you need more power, Pro has you covered. Here’s what you unlock with LatePoint Pro: Manage multiple locations, staff members, and agents Accept payments via PayPal, Square, Mollie, MercadoPago, Flutterwave, Braintree, PayStack, and SureCart along with Stripe and Razorpay Accept local payments via WooCommerce integration. If you want to use any local payments you can use LatePoint Woo Sync with Google Calendar, Outlook, and Apple Calendar Clients can view, manage, reschedule, and cancel bookings without contacting you Send SMS and WhatsApp notifications and scheduled reminders Offer recurring appointments, group bookings, and service packages Add custom fields, address autocomplete, and custom roles Connect Zoom, Google Meet, and Microsoft Teams for automatic video meeting links Clients book in their local time zone, no confusion on either side Block out time on your calendar in seconds when something comes up Issue invoices, send payment links, process refunds, and setup tax Integrate with WooCommerce and Mailchimp Check Out LatePoint Pro Works With Your Stack Works with most Popular WordPress themes (Astra, Kadence, GeneratePress and others) Fully compatible with Elementor, Gutenberg, and page builders LatePoint is compatible with WooCommerce but doesn’t need it to work. To collect payments using local payment methods (pay later), you can use LatePoint Woo Extendable with LatePoint Pro (Calendar integrations, Zoom, WhatsApp, etc.) Blocks This plugin provides 6 blocks. Customer dashboard: Adds a customer dashboard for LatePoint Booking button: Adds a booking button List of resources: Adds a list of bookable resources by type Booking form: Adds a LatePoint booking form Customer login: Adds a customer login form Latepoint calendar: Adds a calendar of events Trusted by 100,000+ Businesses LatePoint is trusted by 100,000+ businesses worldwide, from solo freelancers and independent practitioners to fitness chains and the Nigerian Embassy. Join a growing community of service businesses that have simplified their scheduling with LatePoint. If you want a modern, effortless way to let your customers book online, give LatePoint a try today. Branding Guidelines LatePoint® is a registered trademark. Please use the following format when mentioning LatePoint anywhere: LatePoint [correct] Late Point [incorrect] Latepoint [incorrect] Late point [incorrect]

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C