I agree that Wordpress is probably the most secure major CMS out there, but it's unfortunately still not good. It had a whole bunch of XSS issues lately. XSS sh

I agree that Wordpress is probably the most secure major CMS out there, but it's unfortunately still not good. It had a whole bunch of XSS issues lately. XSS should be a thing of the past if people would implement Content Security Policy. I'm not aware that Wordpress is working on this. This is hardly defensible. On the positive side I think their automatic update mechanism helps a lot and it's a pity other major CMSes don't have that.