Hmm I have seen a lot of wordpress and especially the plugins tend to be very hit and miss when it comes to stability and updates.

It's pretty bad and it really means you have to constantly update them to be reasonably secure. There's a whole service for scanning its vulnerabilities: https://wpscan.com/

Of course every other product has vulnerabilities too but they are not that easily and heavily exploited.