My experience with WordPress ended a few years ago but it was with a few news blogs with 10k daily visitors with 50k page loads. The first "trouble" with WordPress was that I had to fiddle with the config files of Apache, php and MySQL to improve the performance in a old i5 where the websites where hosted.

The worst part of WordPress is that the main redactor (the boss) was continuously installing plugins and themes developed by monkeys that ended more than a few times with the website with "nice and shiny" webshells installed by remote hackers. The most recurring culprit was that the themes used JavaScript libraries that where years old and even if the developers of such libraries updated those for security, the developers of the themes never updated the themes.

I'm looking to create a personal blog and most probably I'll go with WordPress with a official theme.

PS and Edit: I'm not a developer but even I can recognise that accepting inputs from the users without checking that the user only uses text and not special symbols is a bad idea.