Wordpress default theme XSS (admin) and other problems

There is an XSS in the Wordpress default theme. Tested on WordPress version 2.2 Filename functions.php, line 387. Code: form style="display: inline" method="post" name="hicolor" id="hicolor" action="?php echo $SERVER'REQUESTURI'; ?" $SERVER'REQUESTURI' is directly echoed to the user. This problem...