https://wpvulndb.com/
Six security vulnerabilities in core WP just last month.
It's still a mess, and every plugin gives it a bigger attack surface.