In statistics, the majority of sites hacked are WordPress, because the webmasters do not update or can not do it, to the last version of plugins or core WP. Joomla is less popular and has fewer sites hacked. But if you use security plugins you can protect your site. In WP very good is Wordfence.