xss

The culprit code is in the functions.php.

.button {
                        background: #f2f2f2 url(<?php echo wp_guess_url(); ?>/wp-admin/images/white-grad.png) repeat-x scroll left top;
                }

                .button:active {
                        background: #eee url(<?php echo wp_guess_url(); ?>/wp-admin/images/white-grad-active.png) repeat-x scroll left top;
                }


function wp_guess_url() {
        if ( defined('WP_SITEURL') && '' != WP_SITEURL ) {
                $url = WP_SITEURL;
        } else {
                $schema = is_ssl() ? 'https://' : 'http://';
                $url = preg_replace('|/wp-admin/.*|i', '', $schema . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
        }
        return rtrim($url, '/');
}

Does the following make any difference ??? am puzzled

Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4      ----> Oldman case

Server: Apache/2.2.20 (Ubuntu)
X-Powered-By: PHP/5.3.6-13ubuntu3.2   ----> ethicalhack3r case