To be fair, you're pretty much gonna hit trouble if you're using third party plugins and themes for any script. That's because they're made by just about everyone and anyone and often not vetted for security or code quality purposes.

WordPress on its own can be kept moderately secure, as can any other major script in this market. But if you're installing themes and plugins without knowing exactly what they're doing, then you're gonna have security problems regardless of the script. Doesn't matter if its WordPress, Drupal, Joomla, Magento or anything else, third party plugins and themes are usually the weakest part of the site.