Klaviyo

v3.8.0WordPress PluginAudited Today

CRITICAL

WP.org

Total Findings

181

Security Grade

Coding Score

100/100

Security Findings

181

Critical3

High36

Medium94

Low37

Info11

Executive Summary

The Klaviyo plugin for WooCommerce integrates e-commerce tracking and marketing consent features. The audit identified several security concerns, including missing nonce verification on an AJAX handler, lack of input sanitization in the admin settings save routine, and insufficient protection on the cart rebuild parameter. While most REST endpoints use proper authentication, some publicly accessible endpoints expose product data and version information. The uninstall script also fails to clean up plugin options. No critical SQL injection or authentication bypass vulnerabilities were found. The plugin generally follows WordPress security best practices but has room for improvement in nonce enforcement and input validation.

Security Report Card

securityD

standardsA

qualityD

compatibilityD

OverallD

Readiness

Production Ready

Needs Work

WP.org Ready

EAA Compliance

Non-Compliant

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.0Mismatch detected

Categories with Findings

securityWordPress CompatibilityPlugin ConflictsInternationalizationgdprCoding StandardsPlugin LifecyclePHP CompatibilityData PrivacyAccessibilityPerformanceCSRFType Safetyhook-wiringTheme StandardsUpdate SafetyDependenciesMultisiteError HandlingCross-Site ScriptingWooCommerce CompatibilitycompatibilityInformation DisclosureLogging & Debug

Positive Observations

All database queries use $wpdb->prepare() with appropriate placeholders, preventing SQL injection.
Admin settings output uses htmlspecialchars() for escaping, reducing XSS risk in the admin interface.
REST API endpoints for CRUD operations (options, orders, disable) enforce authentication via consumer key/secret validation.
The plugin declares HPOS compatibility using the correct WooCommerce hook.
Newer checkout block integration properly uses Store API extension and handles consent opt-in asynchronously.
Feedback AJAX handler correctly verifies nonce and sanitizes input.
All API calls use HTTPS (KLAVIYO_API_URL_PREFIX = 'https://a.klaviyo.com/') preventing man-in-the-middle attacks
No use of innerHTML or document.write, reducing DOM-based XSS risk
Input from DOM is trimmed before use
Cookie data is base64 encoded and decoded properly
No local storage misuse; cookies set with path=/ and two-year expiry as expected for tracking
Client-side code handles missing data gracefully (e.g., typeof kl_checkout === 'undefined' check)

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

<a href="https://wphealthkit.com/directory/woocommerce-klaviyo"><img src="https://wphealthkit.com/api/badge/woocommerce-klaviyo" alt="Klaviyo security audit by WP HealthKit" /></a>

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

Readiness

Production Ready

Needs Work

WP.org Ready

EAA Compliance

Non-Compliant

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.0Mismatch detected

Categories with Findings

Positive Observations

All database queries use $wpdb->prepare() with appropriate placeholders, preventing SQL injection.
Admin settings output uses htmlspecialchars() for escaping, reducing XSS risk in the admin interface.
REST API endpoints for CRUD operations (options, orders, disable) enforce authentication via consumer key/secret validation.
The plugin declares HPOS compatibility using the correct WooCommerce hook.
Newer checkout block integration properly uses Store API extension and handles consent opt-in asynchronously.
Feedback AJAX handler correctly verifies nonce and sanitizes input.
All API calls use HTTPS (KLAVIYO_API_URL_PREFIX = 'https://a.klaviyo.com/') preventing man-in-the-middle attacks
No use of innerHTML or document.write, reducing DOM-based XSS risk
Input from DOM is trimmed before use
Cookie data is base64 encoded and decoded properly
No local storage misuse; cookies set with path=/ and two-year expiry as expected for tracking
Client-side code handles missing data gracefully (e.g., typeof kl_checkout === 'undefined' check)

Singleton pattern used correctly to prevent multiple instances.

Good use of autoloader to lazily load classes.

REST API endpoints with separate validation functions for version v2.

Backward compatibility for deprecated options via WCK_Options class.

Use of Action Scheduler (`as_enqueue_async_action`) for non-blocking API calls in block checkout.

Proper use of `wp_remote_post` with non-blocking where appropriate.

Separation of concerns: admin, analytics, installation, options, webhooks are in distinct classes.

Version checking and update migration logic implemented.

Block integration with WooCommerce Checkout block supports modern checkout.

Well-structured JavaScript with JSDoc annotations and modular functions.

Uses modern JavaScript features (arrow functions, destructuring, spread operator) for clarity.

Checks for existence of jQuery before using it, preventing errors if jQuery is not loaded.

Implements cookie data merging to avoid overwriting existing data.

Properly uses wp_localize_script pattern to pass server-side variables (public_key, plugin_meta_data, kl_checkout, item) to JavaScript.

Graceful degradation: returns early if kl_checkout is undefined.

Plugin uses native WordPress form controls and standard WCAG-compliant components from WooCommerce blocks.

Checkout block integration uses accessible CheckboxControl from WooCommerce.

Admin notices use appropriate WordPress notice classes (notice-warning, notice-error).

Plugin enqueues scripts at the correct priority and uses wp_localize_script for passing data.

Plugin uses standard JavaScript event listeners for analytics tracking without modifying visual or interactive elements, thus no accessibility barriers introduced.

Code does not generate any HTML output, avoiding common accessibility anti-patterns in rendered content.

CSS and JS are conditionally enqueued only on relevant pages (settings page, checkout, product pages).

Most HTTP requests to Klaviyo are non-blocking (blocking=false) for tracking events like Added to Cart and consent events.

API endpoints use proper permission callbacks and validation.

Transient caching is used for plugin update checking to avoid repeated HTTP calls.