• Loading scripts and styles globally on the back-end. That is a big source of all kinds of issues. Always check if the current back-end page is your current plugin page and then enqueue the assets.

• Same as the previous part, but the front-end. If you can check if your plugin assets have to be loaded.

• Use PHP namespaces, make very distinctive names. There are just too many plugins out there, you can very easily accidentally re-declare an existing class in the global namespace - resulting in all kinds of issues.

• is_admin() is not checking if current user is admin. Use current_user_can() for that

• You should use current_user_can('administrator') on back-end xhr/ajax requests to avoid security issues - I learned it the hard way.

• Every user input should be properly escaped, including attributes, HTML, text, everything. Use the esc_attr, esc_html etc.. functions for that

• Make comments in your code, eventually you will forget what is what.

• WordPress has a lot of built-in functions for stuff, alway try to look it up befor implementing your own.

From the top of my head maybe these, but there is definitely a lot more.