WordPress, phpNuke, phpBB, most of the old PHP CMSes and E-Commerce systems. The code is dirty and hacky, but the software is useful for millions of people.
A lot of people assume WordPress is poorly written because it got a reputation for being insecure. But modern WordPress is pretty well written and in part due to its automatic update mechanism pretty secure.
When was the last time you looked at WordPress?
Building your own userland SQL Prepared Statements 'replacement' using string replacement is not "pretty damn good".
WordPress is notorious for refusing to drop support for ancient, unsupported versions of PHP.
WordPress is a fucking terrible solution to any problem, from a technical point of view.
That 25% of sites use it just proves the successful part, and says nothing about how appropriate it is technically.