I am curious about this seemingly common perception that Wordpress is an insecure product. Is Wordpress, when configured correctly, far less secure than other platforms? (My main thinking is that it is an obvious target due to its incredible marketshare)

A client I had was recently terrified of using Wordpress because an 'SEO expert' had filled her head with conjecture about the insecurity of Wordpress compared to Drupal, referring anecdotally to the White House website using Drupal as some sort of indicator that Drupal is infinitely more secure.

However, looking at CVE data, I don't find massive discrepancies, in fact Drupal had more listed vulnerabilities (almost double) than Wordpress in 2014. Compare the CVE statistics for Drupal http://www.cvedetails.com/vendor/1367/Drupal.html vs. Wordpress http://www.cvedetails.com/vendor/2337/Wordpress.html

I'm just curious if you believe there are inherent risks in Wordpress, or if you meant specifically Wordpress in the wrong hands and with the wrong plugins/extensions etc.