Hi - I thought I'd chime in as I'm about to venture on a project of creating 1/2 dozen stores as demos using the exact same products to show users about how different they are.
I understand your concerns about WordPress I read that article last week and am amazed at how little people know about it's vulnerabilities.
We actually went through a series of stores - and I guess it does depend on your actual requirements.
We've been looking at Presta Shop, CS-Cart (not free but pretty good), smartstore - a .net mvc project which is from nopcommerce, and it's mobile off the shelf and easy to manage.
We read that magento is heavy, and has issues with caching, is not really scalable unless you buy the commercial version, and is expensive to customise, anything outside a purchased template - better dig deep.
Alot of wordpress add ons could be vulnerable, but the simple fact that wordpress is a consistent target, for me from a business perspective makes it a high risk solution, given that there are also other factors that make linux based hosting a sitting duck for being under attack. This is an observation, given that we do both windows and linux projects .
There is also shop factory - A partner of mine has been using shop factory and loves it. He says it's easy to use, and does all he needs.
Granted it's not a free solution either, but there are some modestly priced good solutions out there.
I think you'll find that no matter what you look at there are going to be some shortcomings - it's software but for me, security is the last thing I want to be consistently having to look out for when there are a heap of other solutions that are not going to be as vulnerable.
I use .net based software, but that's my choice. I have some clients on a store we installed 8 years ago and all we've done is upgrade as time goes by and it's proven to be very cost effective for them, however, I'm not going to recommend it here since the audience is primarily after php based solutions. I'm just saying there are better solutions than what wordpress can offer - it is not a CMS - it's a blog with insecure plug ins that look awesomely cool until they are defaced.
Drupal is a CMS and DNN (DotNetNuke)is also a CMS which is what I work with.