If you minimize your reliance on plugins, enable automatic updates, and harden your installation, it's pretty secure. At least I haven't had issues.
Anything can be insecure if it's misconfigured, not just WordPress.
The newer versions have been _much_ better.
> If you minimize your reliance on plugins, enable automatic updates, and harden your installation, it's pretty secure. At least I haven't had issues.
My guess is that it was long too easy to not do any of those things, so it gained a reputation for being insecure. They might have mitigated a lot of the problems, but bad reputations die hard.
That’s what I suggest all my friends who want to create a blog to do.