Plugin & theme audit.

Every admin-only action verified for current_user_can() and the right capability — not just is_user_logged_in().

Every state-changing request verified for a valid, action-bound nonce. Easy to forget; common cause of CSRF-to-RCE chains.

Sanitisation and validation of every user input — not just on save, but at every layer (REST, AJAX, shortcode, block, CLI command).

Every echo / printf / template variable wrapped in the right escaper (esc_html, esc_attr, esc_url, wp_kses). Reflected XSS is still the most common WordPress finding.

Prepared statements throughout. No string concatenation into $wpdb->query(). $wpdb->prepare() with the right format specifiers.

Upload handlers, file deletes, file reads — all checked for path traversal, type validation, and execution-prevention in upload directories.

Uses of eval, unserialize, system, exec, preg_replace /e, extract — flagged and reviewed in context.

Custom login, password reset, OAuth, API token handling — any time the plugin moves identity around, I look closely.

Bundled libraries (jQuery, Composer packages, npm builds) checked for known vulnerable versions and any forks of upstream code.

Any outbound HTTP request reviewed — what's sent, where, and whether the response is trusted blindly.

If the plugin self-updates from a non-WordPress.org source, the update channel's integrity is reviewed end-to-end.

Network admin vs site admin separation, super-admin escalation paths, role-restricted actions across the network.