I work for a hosting company, and we get to see quite a few hacked CMSs. The most hacked—of the popular CMSs—would be Joomla, closely followed by WordPress, and

I work for a hosting company, and we get to see quite a few hacked CMSs. The most hacked—of the popular CMSs—would be Joomla, closely followed by WordPress, and then Drupal. However the margin between Drupal and WordPress is quite big. I can never fathom why Joomla is so popular. It's horrendous to work with. Also, the attention given to security by the majority of the plugin development community, and even Joomla's core dev team is minuscule.