That's the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I'd bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.