diff --git a/wp-admin/admin-header.php b/wp-admin/admin-header.php
index 411954f45..e51f89c27 100644
--- a/wp-admin/admin-header.php
+++ b/wp-admin/admin-header.php
@@ -95,7 +95,7 @@ if ( function_exists('mb_strlen') ) {
 }
 ?>
 
-<img id="header-logo" src="../wp-includes/images/blank.gif" alt="" width="32" height="32" /> <h1 id="site-heading" <?php echo $title_class ?>><a href="<?php echo trailingslashit( get_bloginfo('url') ); ?>" title="<?php esc_attr_e('Visit Site') ?>"><span id="site-title"><?php echo $blog_name ?></span> <em id="site-visit-button"><?php _e('Visit Site') ?></em></a><?php if ( ! get_option('blog_public') ) { ?> <a id="privacy-on-link" href="options-privacy.php" title="<?php esc_attr_e('Your blog is hidden from search engines') ?>"><?php _e('Privacy On') ?></a><?php } ?></h1>
+<img id="header-logo" src="<?php echo esc_url( includes_url( 'images/blank.gif' ) ); ?>" alt="" width="32" height="32" /> <h1 id="site-heading" <?php echo $title_class ?>><a href="<?php echo trailingslashit( get_bloginfo('url') ); ?>" title="<?php esc_attr_e('Visit Site') ?>"><span id="site-title"><?php echo $blog_name ?></span> <em id="site-visit-button"><?php _e('Visit Site') ?></em></a><?php if ( ! get_option('blog_public') ) { ?> <a id="privacy-on-link" href="options-privacy.php" title="<?php esc_attr_e('Your blog is hidden from search engines') ?>"><?php _e('Privacy On') ?></a><?php } ?></h1>
 
 <div id="wphead-info">
 <div id="user_info">
diff --git a/wp-admin/edit.php b/wp-admin/edit.php
index 9df8117fc..67136dd32 100644
--- a/wp-admin/edit.php
+++ b/wp-admin/edit.php
@@ -360,8 +360,8 @@ if ( $is_trash && current_user_can($post_type_object->edit_others_cap) ) { ?>
 <?php } ?>
 
 <div class="view-switch">
-	<a href="<?php echo esc_url(add_query_arg('mode', 'list', $_SERVER['REQUEST_URI'])) ?>"><img <?php if ( 'list' == $mode ) echo 'class="current"'; ?> id="view-switch-list" src="../wp-includes/images/blank.gif" width="20" height="20" title="<?php _e('List View') ?>" alt="<?php _e('List View') ?>" /></a>
-	<a href="<?php echo esc_url(add_query_arg('mode', 'excerpt', $_SERVER['REQUEST_URI'])) ?>"><img <?php if ( 'excerpt' == $mode ) echo 'class="current"'; ?> id="view-switch-excerpt" src="../wp-includes/images/blank.gif" width="20" height="20" title="<?php _e('Excerpt View') ?>" alt="<?php _e('Excerpt View') ?>" /></a>
+	<a href="<?php echo esc_url(add_query_arg('mode', 'list', $_SERVER['REQUEST_URI'])) ?>"><img <?php if ( 'list' == $mode ) echo 'class="current"'; ?> id="view-switch-list" src="<?php echo esc_url( includes_url( 'images/blank.gif' ) ); ?>" width="20" height="20" title="<?php _e('List View') ?>" alt="<?php _e('List View') ?>" /></a>
+	<a href="<?php echo esc_url(add_query_arg('mode', 'excerpt', $_SERVER['REQUEST_URI'])) ?>"><img <?php if ( 'excerpt' == $mode ) echo 'class="current"'; ?> id="view-switch-excerpt" src="<?php echo esc_url( includes_url( 'images/blank.gif' ) ); ?>" width="20" height="20" title="<?php _e('Excerpt View') ?>" alt="<?php _e('Excerpt View') ?>" /></a>
 </div>
 
 <div class="clear"></div>
diff --git a/wp-admin/import/livejournal.php b/wp-admin/import/livejournal.php
index b2f7936ca..981fab65d 100644
--- a/wp-admin/import/livejournal.php
+++ b/wp-admin/import/livejournal.php
@@ -968,7 +968,7 @@ class LJ_API_Import {
 				if ( next_counter <= 0 ) {
 					if ( jQuery( '#<?php echo $id ?>' ).length ) {
 						jQuery( "#<?php echo $id ?> input[type='submit']" ).hide();
-						str = '<?php _e( "Continuing&#8230;" ) ?> <img src="images/wpspin_light.gif" alt="" id="processing" align="top" />';
+						str = '<?php _e( "Continuing&#8230;" ) ?> <img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" id="processing" align="top" />';
 						jQuery( '#<?php echo $msg ?>' ).html( str );
 						jQuery( '#<?php echo $id ?>' ).submit();
 						return;
@@ -997,7 +997,7 @@ class LJ_API_Import {
 					if ( jQuery( '#<?php echo $id ?>' ).length ) {
 						jQuery( "#<?php echo $id ?> input[type='submit']" ).hide();
 						jQuery.ajaxSetup({'timeout':3600000});
-						str = '<?php _e( "Processing next batch." ) ?> <img src="images/wpspin_light.gif" alt="" id="processing" align="top" />';
+						str = '<?php _e( "Processing next batch." ) ?> <img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" id="processing" align="top" />';
 						jQuery( '#<?php echo $msg ?>' ).html( str );
 						jQuery('#ljapi-status').load(ajaxurl, {'action':'lj-importer',
 																'step':jQuery('#step').val(),
diff --git a/wp-admin/includes/dashboard.php b/wp-admin/includes/dashboard.php
index 7b2699130..e83c55b1b 100644
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -424,7 +424,7 @@ function wp_dashboard_quick_press() {
 			<input type="reset" value="<?php esc_attr_e( 'Reset' ); ?>" class="button" />
 			<span id="publishing-action">
 				<input type="submit" name="publish" id="publish" accesskey="p" tabindex="5" class="button-primary" value="<?php current_user_can('publish_posts') ? esc_attr_e('Publish') : esc_attr_e('Submit for Review'); ?>" />
-				<img class="waiting" src="images/wpspin_light.gif" />
+				<img class="waiting" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" />
 			</span>
 			<br class="clear" />
 		</p>
diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index 747898a47..7250086d1 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -376,12 +376,12 @@ function media_buttons() {
 	$out = '';
 
 	if ( $do_image )
-		$out .= "<a href='{$image_upload_iframe_src}&amp;TB_iframe=true' id='add_image' class='thickbox' title='$image_title' onclick='return false;'><img src='images/media-button-image.gif' alt='$image_title' /></a>";
+		$out .= "<a href='{$image_upload_iframe_src}&amp;TB_iframe=true' id='add_image' class='thickbox' title='$image_title' onclick='return false;'><img src='" . esc_url( admin_url( 'images/media-button-image.gif' ) ) . "' alt='$image_title' /></a>";
 	if ( $do_video )
-		$out .= "<a href='{$video_upload_iframe_src}&amp;TB_iframe=true' id='add_video' class='thickbox' title='$video_title' onclick='return false;'><img src='images/media-button-video.gif' alt='$video_title' /></a>";
+		$out .= "<a href='{$video_upload_iframe_src}&amp;TB_iframe=true' id='add_video' class='thickbox' title='$video_title' onclick='return false;'><img src='" . esc_url( admin_url( 'images/media-button-video.gif' ) ) . "' alt='$video_title' /></a>";
 	if ( $do_audio )
-		$out .= "<a href='{$audio_upload_iframe_src}&amp;TB_iframe=true' id='add_audio' class='thickbox' title='$audio_title' onclick='return false;'><img src='images/media-button-music.gif' alt='$audio_title' /></a>";
-	$out .= "<a href='{$media_upload_iframe_src}&amp;TB_iframe=true' id='add_media' class='thickbox' title='$media_title' onclick='return false;'><img src='images/media-button-other.gif' alt='$media_title' /></a>";
+		$out .= "<a href='{$audio_upload_iframe_src}&amp;TB_iframe=true' id='add_audio' class='thickbox' title='$audio_title' onclick='return false;'><img src='" . esc_url( admin_url( 'images/media-button-music.gif' ) ) . "' alt='$audio_title' /></a>";
+	$out .= "<a href='{$media_upload_iframe_src}&amp;TB_iframe=true' id='add_media' class='thickbox' title='$media_title' onclick='return false;'><img src='" . esc_url( admin_url( 'images/media-button-other.gif' ) ) . "' alt='$media_title' /></a>";
 
 	printf($context, $out);
 }
@@ -1214,7 +1214,7 @@ function get_media_item( $attachment_id, $args = null ) {
 	$image_edit_button = '';
 	if ( gd_edit_image_support( $post->post_mime_type ) ) {
 		$nonce = wp_create_nonce( "image_editor-$post->ID" );
-		$image_edit_button = "<input type='button' id='imgedit-open-btn-$post->ID' onclick='imageEdit.open( $post->ID, \"$nonce\" )' class='button' value='" . esc_attr__( 'Edit Image' ) . "' /> <img src='images/wpspin_light.gif' class='imgedit-wait-spin' alt='' />";
+		$image_edit_button = "<input type='button' id='imgedit-open-btn-$post->ID' onclick='imageEdit.open( $post->ID, \"$nonce\" )' class='button' value='" . esc_attr__( 'Edit Image' ) . "' /> <img src='" . esc_url( admin_url( 'images/wpspin_light.gif' ) ) . "' class='imgedit-wait-spin' alt='' />";
 	}
 
 	$attachment_url = get_permalink( $attachment_id );
@@ -1631,7 +1631,7 @@ var addExtImage = {
 		document.getElementById('go_button').style.color = '#bbb';
 		if ( ! document.forms[0].src.value )
 			document.getElementById('status_img').innerHTML = '*';
-		else document.getElementById('status_img').innerHTML = '<img src="images/no.png" alt="" />';
+		else document.getElementById('status_img').innerHTML = '<img src="<?php echo esc_url( admin_url( 'images/no.png' ) ); ?>" alt="" />';
 	},
 
 	updateImageData : function() {
@@ -1640,7 +1640,7 @@ var addExtImage = {
 		t.width = t.preloadImg.width;
 		t.height = t.preloadImg.height;
 		document.getElementById('go_button').style.color = '#333';
-		document.getElementById('status_img').innerHTML = '<img src="images/yes.png" alt="" />';
+		document.getElementById('status_img').innerHTML = '<img src="<?php echo esc_url( admin_url( 'images/yes.png' ) ); ?>" alt="" />';
 	},
 
 	getImageData : function() {
@@ -1650,7 +1650,7 @@ var addExtImage = {
 			t.resetImageData();
 			return false;
 		}
-		document.getElementById('status_img').innerHTML = '<img src="images/wpspin_light.gif" alt="" />';
+		document.getElementById('status_img').innerHTML = '<img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" />';
 		t.preloadImg = new Image();
 		t.preloadImg.onload = t.updateImageData;
 		t.preloadImg.onerror = t.resetImageData;
diff --git a/wp-admin/includes/meta-boxes.php b/wp-admin/includes/meta-boxes.php
index 483de415b..95cdcab56 100644
--- a/wp-admin/includes/meta-boxes.php
+++ b/wp-admin/includes/meta-boxes.php
@@ -207,7 +207,7 @@ if ( current_user_can( "delete_${type_cap}", $post->ID ) ) {
 </div>
 
 <div id="publishing-action">
-<img src="images/wpspin_light.gif" id="ajax-loading" style="visibility:hidden;" alt="" />
+<img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" id="ajax-loading" style="visibility:hidden;" alt="" />
 <?php
 if ( !in_array( $post->post_status, array('publish', 'future', 'private') ) || 0 == $post->ID ) {
 	if ( $can_publish ) :
@@ -432,7 +432,7 @@ function post_comment_meta_box($post) {
 </tr></thead>
 <tbody id="the-comment-list" class="list:comment"></tbody>
 </table>
-<p class="hide-if-no-js"><a href="#commentstatusdiv" id="show-comments" onclick="commentsBox.get(<?php echo $total; ?>);return false;"><?php _e('Show comments'); ?></a> <img class="waiting" style="display:none;" src="images/wpspin_light.gif" alt="" /></p>
+<p class="hide-if-no-js"><a href="#commentstatusdiv" id="show-comments" onclick="commentsBox.get(<?php echo $total; ?>);return false;"><?php _e('Show comments'); ?></a> <img class="waiting" style="display:none;" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" /></p>
 <?php
 	$hidden = get_hidden_meta_boxes('post');
 	if ( ! in_array('commentsdiv', $hidden) ) { ?>
diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
index 97b982aaf..5e3eb5668 100644
--- a/wp-admin/includes/plugin.php
+++ b/wp-admin/includes/plugin.php
@@ -821,7 +821,7 @@ function add_menu_page( $page_title, $menu_title, $capability, $menu_slug, $func
 		add_action( $hookname, $function );
 
 	if ( empty($icon_url) ) {
-		$icon_url = 'images/generic.png';
+		$icon_url = esc_url( admin_url( 'images/generic.png' ) );
 	} elseif ( is_ssl() && 0 === strpos($icon_url, 'http://') ) {
 		$icon_url = 'https://' . substr($icon_url, 7);
 	}
diff --git a/wp-admin/includes/template.php b/wp-admin/includes/template.php
index 6710c7e13..11cca710b 100644
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -65,7 +65,7 @@ function inline_edit_term_row($type, $taxonomy) {
 		<a accesskey="c" href="#inline-edit" title="<?php _e('Cancel'); ?>" class="cancel button-secondary alignleft"><?php _e('Cancel'); ?></a>
 		<?php $update_text = ( 'post_tag' == $taxonomy ) ? __( 'Update Tag' ) : __( 'Update Category' ); ?>
 		<a accesskey="s" href="#inline-edit" title="<?php echo esc_attr( $update_text ); ?>" class="save button-primary alignright"><?php echo $update_text; ?></a>
-		<img class="waiting" style="display:none;" src="images/wpspin_light.gif" alt="" />
+		<img class="waiting" style="display:none;" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" />
 		<span class="error" style="display:none;"></span>
 		<?php wp_nonce_field( 'taxinlineeditnonce', '_inline_edit', false ); ?>
 		<br class="clear" />
@@ -671,7 +671,7 @@ function wp_manage_posts_columns( $screen = '') {
 		$posts_columns['tags'] = __('Tags');
 	$post_status = !empty($_REQUEST['post_status']) ? $_REQUEST['post_status'] : 'all';
 	if ( !in_array( $post_status, array('pending', 'draft', 'future') ) && ( empty($post_type) || post_type_supports($post_type, 'comments') ) )
-		$posts_columns['comments'] = '<div class="vers"><img alt="Comments" src="images/comment-grey-bubble.png" /></div>';
+		$posts_columns['comments'] = '<div class="vers"><img alt="Comments" src="' . esc_url( admin_url( 'images/comment-grey-bubble.png' ) ) . '" /></div>';
 	$posts_columns['date'] = __('Date');
 	// @todo filter per type
 	$posts_columns = apply_filters('manage_posts_columns', $posts_columns);
@@ -697,7 +697,7 @@ function wp_manage_media_columns() {
 	//$posts_columns['tags'] = _x('Tags', 'column name');
 	/* translators: column name */
 	$posts_columns['parent'] = _x('Attached to', 'column name');
-	$posts_columns['comments'] = '<div class="vers"><img alt="Comments" src="images/comment-grey-bubble.png" /></div>';
+	$posts_columns['comments'] = '<div class="vers"><img alt="Comments" src="' . esc_url( admin_url( 'images/comment-grey-bubble.png' ) ) . '" /></div>';
 	//$posts_columns['comments'] = __('Comments');
 	/* translators: column name */
 	$posts_columns['date'] = _x('Date', 'column name');
@@ -1165,7 +1165,7 @@ function inline_edit_row( $screen ) {
 			$update_text = __( 'Update' );
 			?>
 			<a accesskey="s" href="#inline-edit" title="<?php _e('Update'); ?>" class="button-primary save alignright"><?php echo esc_attr( $update_text ); ?></a>
-			<img class="waiting" style="display:none;" src="images/wpspin_light.gif" alt="" />
+			<img class="waiting" style="display:none;" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" />
 		<?php } else {
 			$update_text = __( 'Update' );
 		?>
@@ -2276,7 +2276,7 @@ function wp_comment_reply($position = '1', $checkbox = false, $mode = 'single',
 	<a href="#comments-form" class="save button-primary alignright" tabindex="104">
 	<span id="savebtn" style="display:none;"><?php _e('Update Comment'); ?></span>
 	<span id="replybtn" style="display:none;"><?php _e('Submit Reply'); ?></span></a>
-	<img class="waiting" style="display:none;" src="images/wpspin_light.gif" alt="" />
+	<img class="waiting" style="display:none;" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" />
 	<span class="error" style="display:none;"></span>
 	<br class="clear" />
 	</p>
@@ -2611,7 +2611,7 @@ function parent_dropdown( $default = 0, $parent = 0, $level = 0 ) {
 function browse_happy() {
 	$getit = __( 'WordPress recommends a better browser' );
 	echo '
-		<div id="bh"><a href="http://browsehappy.com/" title="'.$getit.'"><img src="images/browse-happy.gif" alt="Browse Happy" /></a></div>
+		<div id="bh"><a href="http://browsehappy.com/" title="'.$getit.'"><img src="' . esc_url( admin_url( 'images/browse-happy.gif' ) ) . '" alt="Browse Happy" /></a></div>
 ';
 }
 
diff --git a/wp-admin/includes/widgets.php b/wp-admin/includes/widgets.php
index dbc14f12e..aef0dbafa 100644
--- a/wp-admin/includes/widgets.php
+++ b/wp-admin/includes/widgets.php
@@ -202,7 +202,7 @@ function wp_widget_control( $sidebar_args ) {
 		<a class="widget-control-close" href="#close"><?php _e('Close'); ?></a>
 		</div>
 		<div class="alignright<?php if ( 'noform' === $has_form ) echo ' widget-control-noform'; ?>">
-		<img src="images/wpspin_light.gif" class="ajax-feedback " title="" alt="" />
+		<img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" class="ajax-feedback " title="" alt="" />
 		<input type="submit" name="savewidget" class="button-primary widget-control-save" value="<?php esc_attr_e('Save'); ?>" />
 		</div>
 		<br class="clear" />
diff --git a/wp-admin/ms-edit.php b/wp-admin/ms-edit.php
index 951519c82..e15d27591 100644
--- a/wp-admin/ms-edit.php
+++ b/wp-admin/ms-edit.php
@@ -412,7 +412,7 @@ switch ( $_GET['action'] ) {
 				<?php wp_admin_css( 'install', true ); ?>
 			</head>
 			<body id="error-page">
-				<h1 id="logo"><img alt="WordPress" src="images/wordpress-logo.png" /></h1>
+				<h1 id="logo"><img alt="WordPress" src="<?php echo esc_url( admin_url( 'images/wordpress-logo.png' ) ); ?>" /></h1>
 				<form action='ms-edit.php?action=<?php echo esc_attr( $_GET[ 'action2' ] ) ?>' method='post'>
 					<input type='hidden' name='action' value='<?php echo esc_attr( $_GET['action2'] ) ?>' />
 					<input type='hidden' name='id' value='<?php echo esc_attr( $id ); ?>' />
diff --git a/wp-admin/press-this.php b/wp-admin/press-this.php
index a456b0ca3..ccf47281d 100644
--- a/wp-admin/press-this.php
+++ b/wp-admin/press-this.php
@@ -399,7 +399,7 @@ var photostorage = false;
 					jQuery('#waiting').hide();
 					jQuery('#extra-fields').show();
 				}
-				jQuery('#extra-fields').before('<div id="waiting"><img src="images/wpspin_light.gif" alt="" /> <?php echo esc_js( __( 'Loading...' ) ); ?></div>');
+				jQuery('#extra-fields').before('<div id="waiting"><img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" /> <?php echo esc_js( __( 'Loading...' ) ); ?></div>');
 
 				if(photostorage == false) {
 					jQuery.ajax({
@@ -475,7 +475,7 @@ var photostorage = false;
 						<?php } else { ?>
 							<br /><br /><input class="button-primary" type="submit" name="review" value="<?php esc_attr_e('Submit for Review') ?>" id="review" />
 						<?php } ?>
-						<img src="images/wpspin_light.gif" alt="" id="saving" style="display:none;" />
+						<img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" id="saving" style="display:none;" />
 					</p>
 				</div>
 			</div>
@@ -547,11 +547,11 @@ var photostorage = false;
 
 				<li id="photo_button">
 					Add: <?php if ( current_user_can('upload_files') ) { ?><a title="<?php _e('Insert an Image'); ?>" href="#">
-<img alt="<?php _e('Insert an Image'); ?>" src="images/media-button-image.gif"/></a>
+<img alt="<?php _e('Insert an Image'); ?>" src="<?php echo esc_url( admin_url( 'images/media-button-image.gif' ) ); ?>"/></a>
 					<?php } ?>
 				</li>
 				<li id="video_button">
-					<a title="<?php _e('Embed a Video'); ?>" href="#"><img alt="<?php _e('Embed a Video'); ?>" src="images/media-button-video.gif"/></a>
+					<a title="<?php _e('Embed a Video'); ?>" href="#"><img alt="<?php _e('Embed a Video'); ?>" src="<?php echo esc_url( admin_url( 'images/media-button-video.gif' ) ); ?>"/></a>
 				</li>
 				<?php if ( user_can_richedit() ) { ?>
 				<li id="switcher">
diff --git a/wp-admin/widgets.php b/wp-admin/widgets.php
index 1b4cf2caa..3a4c49926 100644
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -363,7 +363,7 @@ require_once( 'admin-header.php' ); ?>
 		<div class="sidebar-name">
 		<div class="sidebar-name-arrow"><br /></div>
 		<h3><?php _e('Inactive Widgets'); ?>
-		<span><img src="images/wpspin_light.gif" class="ajax-feedback" title="" alt="" /></span></h3></div>
+		<span><img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" class="ajax-feedback" title="" alt="" /></span></h3></div>
 		<div class="widget-holder inactive">
 		<p class="description"><?php _e('Drag widgets here to remove them from the sidebar but keep their settings.'); ?></p>
 		<?php wp_list_widget_controls('wp_inactive_widgets'); ?>
@@ -385,7 +385,7 @@ foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) {
 	<div class="sidebar-name">
 	<div class="sidebar-name-arrow"><br /></div>
 	<h3><?php echo esc_html( $registered_sidebar['name'] ); ?>
-	<span><img src="images/wpspin_dark.gif" class="ajax-feedback" title="" alt="" /></span></h3></div>
+	<span><img src="<?php echo esc_url( admin_url( 'images/wpspin_dark.gif' ) ); ?>" class="ajax-feedback" title="" alt="" /></span></h3></div>
 	<?php wp_list_widget_controls( $sidebar ); // Show the control forms for each of the widgets in this sidebar ?>
 	</div>
 <?php