On September 3, 2026, LatePoint, the most installed appointment plugin in the WordPress directory, shipped a fix with a blunt description: two customers checking out at the same moment could book the same slot. Three weeks later, FluentBooking fixed double bookings caused by the daylight saving time change.
These are not isolated accidents. A booking plugin handles exactly what WordPress handles poorly by nature: time, time zones, scheduled tasks, and money collected before the service has taken place. Every weakness costs unhappy customers or lost slots.
You also need to know what you are booking. An osteopath appointment, a night in a holiday cottage and a seat in a group class do not call for the same tool. Many disappointments come from an excellent plugin installed for the wrong problem.
This comparison judges ten solutions on what matters once the site is live: calendar sync, time zone handling, payments and deposits, reminders, staff, and security track record. Prices and install counts are those displayed in October 2026.
How we ranked them
We read the official pages, the WordPress.org directory listings, the documentation and the changelogs of each tool. The changelogs are invaluable: they tell you what broke, far better than sales pages do.
The criteria are as follows. Calendar sync, and above all its direction: one-way pushes bookings to Google Calendar, two-way also blocks slots that are already taken. Time zone and daylight saving time handling. Payment methods and the ability to take a deposit. Reminders, and what actually triggers them.
Then come staff and resource management, the dependency on WooCommerce, the security record and the real cost. Many vendors show a discounted first-year price, with renewals at full price: we flag it every time.
Appointments, rentals, classes: three different problems
The appointment
A customer picks a service of fixed length, with one person, at a given time. The scarce resource is an employee’s calendar. The key questions are each team member’s availability, buffer times between two customers and reminders to reduce no-shows.
The rental
A cottage, a bed and breakfast or equipment is rented by the night or the day, with seasonal prices, minimum stays and sync with Booking.com or Airbnb. Bookly says so itself in its FAQ: its current version will not fit a hotel or a rental business.
The class and the event
A session takes several people, with a limited number of seats. Some appointment plugins also handle this case: Amelia sells event tickets, and LatePoint added events to its free version in September 2026. Identify your case before comparing anything.
1. LatePoint: deposits in the free version
What it does
LatePoint offers a clean, step-by-step booking flow with a clear admin area. It arrived in the WordPress.org directory in January 2025, after years of distribution outside it, and now has more than 100,000 active installs.
Strengths
Its free version is the most generous in this comparison for taking money: unlimited appointments, payments through Stripe, PayPal or Razorpay, and a deposit at booking, fixed or as a percentage, to hold the slot. Email notifications are included, and events since version 5.7.0 in September 2026.
Limits
Scheduled reminders, SMS, WhatsApp, Google Calendar sync, multiple staff and multiple locations require the Pro version. It has a long security record, as the case below shows.
Price and audience
The Starter plan costs $79 for the first year for one site, instead of $99, the Scale plan $149 for five sites and the Agency plan $299 for a hundred sites. All of them include every feature: only the number of sites changes. LatePoint suits coaches, salons and clinics that want to collect a deposit without paying up front.
The real case: LatePoint, September 2024, two critical flaws
LatePoint’s story in the autumn of 2024 shows better than anything what a booking form exposes. It is documented in detail by Wordfence, by the US vulnerability database NVD and by WPScan, with a precise timeline from discovery to fix.
Two open doors in the booking flow
On September 17, 2024, István Márton, a researcher at Wordfence, analyzed LatePoint. The plugin was not yet in the official directory: Wordfence then estimated it ran on more than 7,000 sites. He found two flaws that Wordfence rated 9.8 out of 10, exploitable by a visitor without an account.
The first was hidden in the function that changes a customer’s password. It expected a reset token without checking its form. By sending an array instead of a string, an attacker turned the token lookup into a simple condition on the user ID. Knowing that ID, an easily obtainable value, was enough to change the password.
The second was simpler still. At the step where the visitor enters their details, the form accepted any customer parameter, including a WordPress user ID. The plugin then logged the visitor in as that account, administrator included.
One condition limited the reach of these flaws: they only reached WordPress accounts if the option that uses WordPress users as customers was enabled. It is disabled by default. Without it, only LatePoint’s own customer records, stored in a separate table, were exposed.
Seven days to fix
The same day, Wordfence deployed a firewall rule for its paying customers and contacted the vendor, who confirmed the inbox to use for the discussion, then got the full details. On September 19, the LatePoint team acknowledged the report and started the fix. Version 5.0.12 partially fixed it on September 20, and version 5.0.13 fully fixed it on September 24.
Wordfence published its analysis on October 7, NVD recorded both flaws the next day, and users of the free Wordfence version received the firewall rule on October 17, thirty days after paying customers. Wordfence praised the vendor’s quick response. No exploitation was reported in the sources we read, and neither flaw appears in the US agency CISA’s catalog of exploited vulnerabilities.
What the story teaches
A booking form is, by design, a public door open to anonymous visitors. It creates records, sometimes logs customers in and takes money. Each of those functions is an attack surface, and a booking plugin combines more of them than a simple contact form.
Linking customers to WordPress accounts, convenient for giving them a personal area, changes the scale of the risk: from a leak of customer records to a full site takeover. Only enable that option if you really need it.
Finally, a web application firewall helps, but the free version often gets its rules a month late. The only real protection is the update, applied quickly. Our guide to WordPress security hardening explains how to organize that.
And since then
LatePoint joined the directory in January 2025 and has grown more than tenfold in number of sites. Researchers followed: other flaws were fixed in 2025, and version 5.7.3, at the end of September 2026, again thanks Wordfence for reported flaws. Popularity attracts researchers, which is good news for those who update and bad news for those who let things slide.
2. Amelia: appointments and event tickets
What it does
Amelia handles both appointments and ticketed events, which sets it apart from most of its competitors. Its Lite version, in the directory, has more than 90,000 active installs, and the paid plans are sold on the website of its publisher, Melograno Venture Studio.
Strengths
The Lite version shows slots in the customer’s time zone and accepts Square payments for free. The paid versions add two-way Google Calendar sync, Outlook and Apple, PayPal, Stripe, Mollie, Razorpay or WooCommerce, deposits and WhatsApp reminders. Each employee can have up to six calendars checked to block their busy slots.
Limits
The Lite version excludes unlimited employees, reminders, custom notifications and multilingual support. SMS go through Amelia’s own service, billed separately and prepaid, with a balance that must stay positive. Watch the version numbers too: Lite is at 2.4, the paid version at 9.9, and security advisories target one or the other.
A critical flaw in the paid version, made public on September 1, 2026, let a visitor without an account become an administrator on versions 8.0 to 9.6.2. It had been fixed since version 9.6.3, released on July 7, 2026.
Price and audience
Amelia offers four plans, Starter, Standard, Pro and Elite, yearly or lifetime, with a 15-day refund. At the time of writing, the Starter and Standard plans cost $49 and $99 per year for one domain, Pro $219 for the first year instead of $329 for five domains, and Elite $399 instead of $599 for unlimited domains, before tax. Amelia suits salons, clinics and studios with several employees that also sell seats at events.
3. Bookly: the veteran, à la carte
What it does
In the directory since 2014, Bookly has more than 60,000 active installs. It works in layers: a free core, a Pro add-on, paid add-ons sold one by one and online services grouped under the name Bookly Cloud.
Strengths
The free version shows slots in the customer’s time zone and handles email, SMS and WhatsApp notifications. The Pro version adds a time zone switcher, unlimited staff, Google Calendar sync and WooCommerce compatibility. Bookly Cloud offers a hosted scheduled task, designed so reminders go out on time.
Limits
The free version is limited to five services, with no online payment. Above all, on the current pricing grid, Stripe, PayPal and deposits only start at the Business plan, not the Pro plan. In 2026, Bookly fixed two flaws that let a customer bring the price of a service down to zero, which we come back to below.
Price and audience
At the time of writing, the Pro plan costs $39 per year for one site during the autumn sale, instead of $99, and the Business plan $69, instead of $129. Full two-way Google Calendar sync also exists as a separate add-on. Bookly suits single-location service businesses that want to start for free and pay feature by feature.
4. Simply Schedule Appointments: polished, but payments cost a lot
What it does
Simply Schedule Appointments, from NSquared, has more than 50,000 active installs and the best rating in this comparison on the directory. From the Plus plan, it integrates with Gravity Forms and Formidable Forms, so you can keep a form you have already built, as our comparison of WordPress form plugins explains.
Strengths
The free version is complete for a freelancer. The Plus plan checks for conflicts in your Google Calendar and adds Zoom, Google Meet and group bookings. Time zones adapt to each visitor, and ICS subscription feeds let you follow your appointments in any calendar.
Limits
Stripe and PayPal payments and SMS only come with the Professional plan, team management with the Business plan. We found no documented deposit. In 2026, the vendor fixed an SQL injection exploitable without an account, and a bug that charged a Stripe customer for an appointment the plugin then refused to record.
Price and audience
At the time of writing, the Plus plan costs $99 per year, Professional $199 and Business $399, for one site. These are introductory prices: the vendor states that renewals are at full price, $129, $249 and $499. Simply Schedule Appointments suits consultants and small teams that want a polished free start.
5. FluentBooking: a Calendly inside WordPress
What it does
FluentBooking, from WPManageNinja, the publisher of Fluent Forms and FluentCRM, arrived in the directory in July 2024 and has more than 20,000 active installs. It follows the logic of online scheduling tools: meeting types, availability windows, a link to share.
Strengths
The free version handles one-on-one meetings, buffer times, booking limits and automatic time zone conversion, with the option to lock a fixed time zone, plus email notifications. The Pro version adds two-way Google, Apple, Outlook and Nextcloud, Stripe, PayPal, SMS and WhatsApp through Twilio, group meetings and round robin.
Limits
Calendar sync and payments are reserved for the Pro version. It is a meeting scheduler more than a salon planner with staff and resources. Version 2.5.0, at the end of September 2026, fixed double bookings at the daylight saving time change, lost or duplicated reminders and coupons used beyond their limit during simultaneous bookings.
Price and audience
At the time of writing, the Solo plan costs $63 for the first year for one site, instead of $79, the Small Business plan $159 for five sites and the Agency plan $319 for fifty sites. FluentBooking suits consultants, sales and recruiting teams already using the Fluent tools.
6. WooCommerce Bookings: booking as a product
What it does
WooCommerce’s official extension turns a booking into a product, sold through the store’s cart. It is not in the WordPress.org directory but on the WooCommerce marketplace, where it shows more than 20,000 installs. It manages resources, staff, rooms or equipment, the number of persons, availability rules and buffer periods.
Strengths
For a store that already sells physical products, everything goes through the same checkout, the same gateways and the same emails. A booking can require the merchant’s confirmation before payment, which is useful for renting expensive equipment.
Limits
The documentation sets two clear limits. Only one Google Calendar can be connected to the site, from the admin account, one way or both ways. Conversion to the visitor’s time zone only applies to bookings in minutes or hours: a day booking always displays in the site’s time zone.
The extension’s marketplace rating is low, 2.7 out of 5, and in October 2026 its listing showed testing with WordPress 7.0, while version 7.1 was already out.
Price and audience
At the time of writing, the extension costs $249 per year. Deposits require another extension, WooCommerce Deposits, at $219 per year, that is $468 before you even think about reminders. WooCommerce Bookings suits existing stores that sell rentals or services alongside their products; our selection of WooCommerce plugins to boost sales completes the picture.
7. Easy Appointments: several locations on a small budget
What it does
Easy Appointments, with more than 10,000 active installs, builds its slots from three linked elements: a location, a service and a worker. The free version already handles several locations, services and workers, with confirm and cancel links in emails, custom fields and a calendar view.
Strengths and limits
Its single paid extension adds two-way Google Calendar sync, SMS and WhatsApp through Twilio, a deposit or full payment through Stripe, PayPal or WooCommerce, and iCalendar feeds. On the other hand, the version 4.0 redesign in August 2026 was followed by many security fixes, including one that let a visitor without an account change or delete appointments.
The vendor’s site looks poorly maintained, with a “special price for BETA period” notice still online. Do not confuse this plugin with Easy!Appointments, a standalone application with its own flaws.
Price and audience
The “All in One” extension starts at $39 for one site and one year of updates. Easy Appointments suits multi-location businesses on a small budget, and developers who want a simple free base.
8. BookingPress: powerful, but outside the directory
A closure never explained
BookingPress was closed in the WordPress.org directory on February 1, 2025, for a “Guideline Violation”, without the guideline in question being made public. A few days later, its team stated on the forum that it was not a security matter and that the situation was temporary. Twenty months later, the plugin is still closed.
What it does
The vendor still distributes a free Lite version and a Pro version from its own site, with regular updates, the latest on September 30, 2026. The Standard plan includes staff management, more than twenty payment gateways and email, SMS and WhatsApp reminders; a deposit add-on is available in every paid plan.
Limits
The Pro version had four flaws in 2026, one of which, in May, let a visitor without an account upload a file to the server through a signature field. Another, in July, exposed customers’ booking data and let attackers change their appointments. The Lite version had its own flaws in 2026, including one, in August, that let a visitor without an account change the price of their booking. All are fixed, and no exploitation has been confirmed.
Outside the directory, you depend solely on the vendor’s channel for updates. Check that they actually reach your dashboard before relying on them.
Price and audience
At the time of writing, the Standard plan costs $89 per year for one site, instead of the regular $99, the Professional plan $139 for three sites and the Enterprise plan $249 for twenty sites. BookingPress only suits those who will closely follow security advisories and updates.
9. VikBooking: when you rent out nights
What it does
VikBooking, with more than 8,000 active installs, is a hotel booking engine combined with property management software. It handles rooms, refundable or non-refundable rate plans, availability calendars, housekeeping and guest pre-check-in.
Strengths and limits
The Pro version adds seasonal rates, minimum and maximum stays, more than sixty payment gateways and reminders through scheduled tasks. Sync with Booking.com, Airbnb or Expedia goes through a separate extension, Vik Channel Manager, which requires an e4jConnect subscription whose price depends on the number of rooms and channels.
Price and alternatives
At the time of writing, VikBooking Pro costs €149, with a one-year license for one site, and Vik Channel Manager €89 as a one-time purchase, plus the subscription. Two alternatives deserve a look: MotoPress Hotel Booking, more than 10,000 installs, with deposits in the free version and iCal sync in its paid version, and Booking Calendar, more than 40,000 installs, for full-day or time-slot bookings. VikBooking suits holiday cottages, bed and breakfasts and small hotels.
10. Embedded Calendly: the no-plugin option
What it does
Calendly has no official plugin in the directory. Its documentation explains how to embed it with a simple Custom HTML block, in three forms: inline in the page, a pop-up text link or a floating pop-up widget. A third-party embed plugin has more than 10,000 installs, but nothing forces you to use it.
Strengths
Nothing to maintain in WordPress, no attack surface added to your site, and time zones handled by a service that does nothing else. For a freelancer, it is often the most stress-free solution.
Limits
The free plan is limited to one event type and one connected calendar. Stripe and PayPal payments start at the Standard plan, as do text reminders, limited to 180 characters. The cost is per seat, so it climbs with the team. The data and the booking flow live at Calendly, and the third-party script raises the consent question covered in our guide to cookie consent.
Price and audience
At the time of writing, the Standard plan costs $10 per seat per month billed yearly, $12 monthly, and the Teams plan $16 billed yearly, $20 monthly. Calendly suits freelancers and sales teams that want zero maintenance.
Time zones, daylight saving time and reminders: what breaks in practice
A city, not an offset
In Settings, then General, the Timezone field accepts a city or a fixed offset from Coordinated Universal Time. Choose a city, Paris or New York for example. An offset such as UTC+1 does not follow daylight saving time: for seven months, all your slots would be an hour off.
Serious plugins rely on the wp_timezone() function, available since WordPress 5.3, which returns the site’s time zone and falls back to the manual offset if no city is chosen. The initial setting therefore drives everything else.
Daylight saving time, a recurring bug
The 2026 changelogs prove it. LatePoint 5.7.0 fixes a fatal error in the admin calendar for time zones where daylight saving time starts at midnight. FluentBooking 2.5.0 fixes double bookings at the time change. Amelia 2.4.11 fixes a time offset in the event bookings export.
Before launching a service, test bookings around the time change, the last Sunday of March and the last Sunday of October in Europe, the second Sunday of March and the first Sunday of November in the United States. If you serve customers in other countries, also test with a browser set to another time zone.
Reminders depend on WP-Cron
WordPress has no real scheduler. Its scheduled task system, WP-Cron, only fires when a page loads. The official documentation gives the example of a task scheduled for 2:00 PM that only runs at 5:00 PM, because nobody visited in between. On a low-traffic site, an appointment reminder can therefore go out too late.
The fix is to disable visit-based triggering and call WP-Cron from the server’s scheduler. In wp-config.php, add this line.
define( 'DISABLE_WP_CRON', true );Then, in the server’s crontab, run it every five minutes, here with WP-CLI.
*/5 * * * * cd /path/to/site && /usr/local/bin/wp cron event run --due-now --quietBookly sells a hosted scheduled task service for this exact reason. Our guide to WP-Cron and system cron covers the setup in detail.
One-way or two-way sync
One-way sync sends your bookings to Google Calendar: handy to see them on your phone, but a personal appointment does not block the slot on the site. Two-way sync also reads the busy slots in the calendar and removes them from availability. That is the setting that prevents double bookings with your private life, and it is almost always paid.
Security: why booking forms are a target
When the customer sets the price
A booking plugin receives data from the visitor that affects the amount: a tip, a quantity, a number of persons. If the server does not recalculate everything, the customer can set their own price. In 2026, Bookly fixed a negative tip that brought the total down to zero, then quantities that let users book paid services for free.
Amelia Lite, up to version 2.4.5, let a visitor without an account get approved bookings without completing payment. For a business that lives on its slots, this kind of flaw costs revenue directly.
A frequent target
In a single week of September 2026, Wordfence’s weekly report listed flaws in Amelia, Bookly, LatePoint, Easy Appointments, Booking Calendar, VikBooking and MotoPress Hotel Booking. No booking plugin flaw was in CISA’s catalog of exploited vulnerabilities at that date, but the pace calls for discipline.
Three habits are enough: apply updates quickly, regularly compare confirmed bookings with the payments received in your gateway’s dashboard, and only link customers to WordPress accounts when essential. Our comparison of WooCommerce payment gateways helps you choose the dashboard that will serve as the reference.
How to choose
- A solo consultant: FluentBooking or Simply Schedule Appointments in their free versions, or Calendly if you want nothing to maintain.
- A salon or a clinic with several employees: LatePoint, Amelia or Bookly, depending on your need for deposits and reminders.
- A WooCommerce store: WooCommerce Bookings, or an appointment plugin with a WooCommerce integration.
- A nightly rental: VikBooking, MotoPress Hotel Booking or Booking Calendar.
- Classes and events: Amelia, or LatePoint since it added events.
Then work out the cost at renewal, not for the first year, and add the essential add-ons: SMS, deposits, two-way sync. The ranking often changes at this stage.
Summary table
| Solution | Installs | Deposit | Two-way calendar | Price (Oct. 2026) |
|---|---|---|---|---|
| LatePoint | 100,000+ | Free | Pro | From $79 first year |
| Amelia | 90,000+ | Paid | Paid | From $49 per year |
| Bookly | 60,000+ | Business plan | Business or add-on | Pro from $39 first year |
| Simply Schedule Appointments | 50,000+ | Not documented | Conflict check (Plus) | From $99 per year |
| FluentBooking | 20,000+ | Not documented | Pro | From $63 first year |
| WooCommerce Bookings | 20,000+ | $219 extension | One calendar per site | $249 per year |
| Easy Appointments | 10,000+ | Extension | Extension | From $39 |
| BookingPress | Outside directory | Paid add-on | Paid | From $89 first year |
| VikBooking | 8,000+ | Depends on gateway | Rental channels (paid) | Pro €149 (one-year license) |
| Embedded Calendly | Online service | Payments from Standard | Built in | Free, then $10 per seat |
Frequently asked questions
Can I take a deposit for free?
Yes, with LatePoint: its free version accepts a fixed or percentage deposit, through Stripe, PayPal or Razorpay. Elsewhere, deposits are paid: Business plan or add-on at Bookly, paid version at Amelia, extension at Easy Appointments, separate extension for WooCommerce Bookings.
Does Google Calendar sync work both ways?
Often, but in paid plans: Amelia, Bookly, FluentBooking Pro and the Easy Appointments extension. WooCommerce Bookings allows it too, but with a single calendar for the whole site, the admin account’s.
How do I avoid time zone errors?
Set the site’s time zone to a city, pick a plugin that shows slots in the customer’s time zone, and test bookings around the daylight saving time change before opening the service.
Do I need WooCommerce?
Only for WooCommerce Bookings. The other plugins take payments on their own, and offer an optional WooCommerce integration, useful if you want a shared cart with your products.
Is Calendly better than a plugin?
For a freelancer with no payments and no team, often yes: nothing to update, and a sufficient free plan. As soon as you need to take money, manage several employees or keep the data in-house, a plugin becomes cheaper.
Are booking plugins safe?
They are frequent targets, because they expose sensitive functions to the public. Serious vendors fix quickly: security mostly depends on how fast you update and on checking the payments you receive.
Conclusion
Choose a booking plugin for the problem you have, an appointment, a night or a seat in a class, rather than for the length of its feature list. LatePoint offers the best free start for taking money, Amelia covers appointments and events, Bookly builds up à la carte, and VikBooking is the clear choice for rentals.
LatePoint’s story is a reminder of the rest. A booking form is a public door that takes money: set the time zone to a city, replace WP-Cron with a real scheduled task, check your payments and update without waiting.
Sources
- WordPress.org (October 2026). LatePoint
- LatePoint (October 2026). Pricing
- Wordfence, István Márton (October 7, 2024). 7,000 WordPress Sites Affected by Unauthenticated Critical Vulnerabilities in LatePoint WordPress Plugin
- NVD (October 8, 2024). CVE-2024-8911
- NVD (October 8, 2024). CVE-2024-8943
- WPScan (October 8, 2024). LatePoint < 5.0.13, Authentication Bypass
- WordPress.org (October 2026). Amelia
- Amelia (October 2026). Pricing
- Amelia. Google Calendar integration
- Amelia. SMS notifications
- NVD (September 2026). CVE-2026-9055
- WordPress.org (October 2026). Bookly
- Bookly (October 2026). Pricing
- Bookly. Bookly Cloud
- NVD (2026). CVE-2026-2519
- NVD (2026). CVE-2026-86838
- NVD (2026). CVE-2026-16582
- WordPress.org (October 2026). Simply Schedule Appointments
- Simply Schedule Appointments (October 2026). Pricing
- WordPress.org (October 2026). FluentBooking
- FluentBooking (October 2026). Pricing
- WooCommerce (October 2026). WooCommerce Bookings
- WooCommerce. Bookings Google Calendar integration
- WooCommerce. Bookings timezones
- WooCommerce (October 2026). WooCommerce Deposits
- WordPress.org (October 2026). Easy Appointments
- WordPress.org (closed February 1, 2025). BookingPress
- WordPress.org forums (February 2025). This plugin has been closed as of February 1, 2025
- BookingPress (October 2026). Pricing
- BookingPress. Release notes
- NVD (May 2026). CVE-2026-6960
- WPScan (July 2026). BookingPress, CVE-2026-9830
- WordPress.org (October 2026). VikBooking
- VikWP. Vik Channel Manager
- WordPress.org. MotoPress Hotel Booking Lite
- WordPress.org. Booking Calendar
- Calendly (October 2026). Pricing
- Calendly. Embed options overview
- Calendly. How to send text messages with Workflows
- WordPress.org Documentation (July 2026). Settings General Screen
- WordPress Developer Resources. wp_timezone()
- WordPress Developer Resources. Cron
- WordPress Developer Resources. Hooking WP-Cron Into the System Task Scheduler
- Wordfence (September 2026). Weekly WordPress Vulnerability Report, September 14 to 20, 2026
- Calendly. How to add Calendly to a WordPress site
LaFactory designs, builds and maintains WordPress and WooCommerce sites, online booking and payments included. Talk to us about your WordPress project.