https://wordpress.org/plugins/ shows 45,129 Wordpress plugins.
https://pypi.python.org/pypi?:... shows 3242 Plone addons.
If you assume rough parity in terms of line of code between a Plone addon and a Wordpress plugin (a dangerous assumption), 10x more Wordpress related CVEs would indicate that Wordpress has a lower density of CVEs per LOC than Plone does.
But, of course, even that comparison is a misleading one to make. There are too many other factors that skew these numbers to draw any meaningful conclusions from them. CVEs simply weren't intended to be used for this kind of comparison.