Windows was originally built without security as a major focus, but has been improved vastly. So has WordPress. Except for a few rare cases where security was a primary goal, such as OpenBSD, most software will be discovered to have vulnerabilities at some point in time.

I meant Windows 95 and 98. NT is one of the vast improvements I had in mind.

OpenBSD has had plenty of vulnerabilities, including a couple of remote ones.

So it's a good example of software built with security as a primary focus that still has vulnerabilities. I can think of few examples of software that has never had vulnerabilities discovered. OpenSSH maybe?

OpenSSH has had more than its share of vulnerabilities.

seL4!

...wait, that's cheating, isn't it?

The fact it's been written in PHP is meaningless. As for "designed without security as a goal", I think you'll find that's true for most web apps.