There is only one Google and it is operated by professionals. Who do not need to disclose the vulnerabilities that they find.

Wordpress is pretty much the exact opposite of that.

We can say the same about most of open source.

It's the WordPress plugin ecosystem that's more often the security nightmare though.

Yes, and if you take Linux for example, there are also tons of exploit for it.

	▲	zelphirkalt 21 hours ago \| parent [-]
		True, but then again WP is a very simple system, in comparison to the Linux kernel, and WP operates on a very different level, at which it should be much easier to get right. Also WP is not written in C. Granted, PHP is not all that great either, but probably still miles ahead, when comparing it to having to write bug-free C code, as one doesn't have to deal with all the manual memory management stuff, which people, even experienced engineers _will_ get wrong at least sometimes (remember the Chromium statistics about vulnerabilities).