My reply to this would be that this is very broad.
In my experience, if you really want to make your infrastructure more secure, you need to explicitely define what it is you want to avoid.
Taking your first point: You say "using the WordPress environment as a stepping stone to gain more access". What type of stepping stone would this be? How can malicious JS on the WP instance escalate its privileges?
