It’s a huuuugely popular CMS used on around 40% of all websites on the internet, and it has around 70,000 plugins available of varying quality. Most exploits are from badly written plugins.