Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on http://www.blog.mainsite.com.

Now there is a requirement that the blog appears as http://www.mainsite.com/blog. I can install PHP, MySQL and Wordpress on our main website IIS server; my question is there are security and performance concerns? Every now and then, a new vulnerability is found in Wordpress and PHP; Is it fine to bring such vulnerable technologies to our main web server? If the admin account if the wordpress blog gets compromised, can this cause any issues for the main web application?

and if it is a bad idea to bring a new stack of technology to our main IIS web server, how can we achieve http://www.mainsite.com/blog instead of current http://www.blog.mainsite.com?