- huge and powerful
- vividly maintained and extended by lots of developers
- rarely features security issues which aren't fixed immediately
... the question arises whether the quality of its code base is in this case maybe rather an academic issue.
I tried to use WordPress once. I downloaded a theme from wordpress.org with the assumption that themes are reviewed before making there. Nevertheless, I did some basic pentesting before putting my app live, and I quickly found a XSS vulnerability in the search bar of the theme (their paid version featured the same vulnerability). Maybe my experience is not to be generalised to WordPress in general, but it put me off.
WordPress plug ins are - as far as I know - not reviewed. You're at the mercy of the respective developer.
>Currently there are 224 plugins in the review queue, 198 of which are awaiting their initial review.
A few years ago, while searching for a development role, I was rejected by couple of people at a company with feedback that my code sample was not of good quality. Later I got the chuckle when I noticed the same people subscribed (paid) to my service that uses the provided code sample.