WordPress used to be quite vulnerable a few years ago, but nowadays not so much, just avoid less popular plugins and you should be ok. Of course since it's the most widely used cms's out there, its a prime target for hackers. But the "WordPress is vulnerable" thing is much of a meme in the current day.