I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (in the theme), XSS vulnerabilities, etc.?
I tried WP-SCAN and some other scanners, but I found nothing suspicious.