What "Stolen Server Memory" consists of ?
I will quote from my answer given on This Thread.
Stolen memory describes buffers that are in use for sorting or for hashing operations (query workspace memory), or for those buffers that are being used as a generic memory store for allocations to store internal data structures such as locks, transaction context, and connection information. The lazywriter process is not permitted to flush Stolen buffers out of the buffer pool.
Plan cache is not part of stolen memory.
How can I query rest of things that are included into "Stolen Server Memory" ?
AFAIK their is no query to tell what "actually" stolen memory consists and how much. You can run
DBCC MEMORYSTATUS() command to see the value of stolen memory.