Effectively at the moment, there are approximately 30,000+ plugins that are not empty in the WordPress.org repository. These plugins are submitted for inclusion and are manually reviewed by volunteers before making them available on the repository. Inclusion of plugins and themes in the repository is not a guarantee that they are free from security vulnerabilities.
Keep in mind the fact that even though some plugins may be secure at the moment the new plugin updates may bring the security issues.
One great resource to read is:
Because of the dynamic nature of the plugins (read: they are updated), keep in mind to check the plugins on daily bases.
In order to perform static plugin source code audit, the following tools can be used:
RIPS: A static source code analyzer for vulnerabilities in PHP scripts
PHP-sat: Static analysis for PHP
Yasca: It could best be described as a "glorified grep script" plus an aggregation of other open-source tools.
And other tools based on Linux grep command.
There are also tools that work dynamically (runtime) as you may read in the OWASP document, and this is also important.
Let's just say some "bad" plugins may contain images with hidden data that can dynamically convert to bad PHP code instructions.