Suspicious Wordpress Code

[masterb56]

If I were you, I'd do an sql backup, find another decent clean theme and just start from there. It seems that those theme files are now dirty, and most probably have infected your server/vps.

[desert fox]

"&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_uagent)

looks like a shell to me check for backdoors remove any new files

[trival]

i already did . but i really cant tell if my site is clean

[Phogo]

Where did you get your theme from? Alot of "nulled" script sites release themes with nasty hidden things in. If you have a timthumb file make sure its upto date. If you like i can have a look for you.

[SplitIce]

its a SEO spam hack, creates fake pages with linkbacks. Ive seen it alot, most likely there are also other compromized files.

My advice, use the latest wordpress version (and versions of your plugins). And under no circumstances use nulled themes.

For one it rips of the developer, two unless you know PHP and check over them there is a good chance that you will have a shell or similar code in there somewhere.

Do a rebuild.
Keep the database and any uploaded files, although go through them looking for any .php's
And be more careful in the future.