Wordpress itself is pretty secure. The plugin and Themes are the issue. One of the downsides of open source is that anyone can make a plugin and there is no minimum standards. While I hate ecosystems like Apple, it does have its advantages.