Major Loopholes
Weak credentials, exposed admin pages, directory listing
Plugin/Software Issues
Outdated CMS, vulnerable plugins, CVE exploits
Script Vulnerabilities
XSS, SQL injection, unsanitized input flaws
Potential Backdoors
Suspicious files, unknown code, new admin users