I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (in the theme), XSS vulnerabilities, etc.?

I tried WP-SCAN and some other scanners, but I found nothing suspicious.

closed as off-topic by Iszi, Steve, schroeder, Gilles, Scott Pack Jul 28 '15 at 2:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Iszi, Steve, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'm assuming that the custom theme will not have known vulnerabilities and you need to test for them by scratch? – schroeder Jul 27 '15 at 17:14
  • Thanks for the title correction, so yeah, where should I focus on finding unknown vulnerabilities? – Danny Babbev Jul 27 '15 at 17:16
  • Hm. That question is really, really broad. If you look at other known vulnerabilities in other themes, you might get an idea what to look for, but the question as asked is hard to answer in this format. – schroeder Jul 27 '15 at 17:21
  • I'm asking for information of known weak places on wordpress themes. And basically, what to look for, as you said. – Danny Babbev Jul 27 '15 at 17:26