I am not a security tester, however, your test planning will vary depending on whether you need to maintain the secure status of the web application, or whether you are doing a one-off "this application is secure" set of tests.
In both cases, I do think you need to plan - but for one-off test sets you don't need to plan for repeatability.
I'd look at classes of common vulnerabilities and potential harm, and use a matrix of these to prioritize tests: starting with common, high damage potential scenarios and working through to the less damaging, then less common scenarios.
Your plan here should be a living document - a template of techniques to use to try to break the security of the application. That way, you don't accidentally overlook something in your testing, and your test cases document the methods you used and the results you received.