Fixed: add_query_arg/remove_query_arg vulnerabilit

I checked the code of Version 3.7.6, why the add_query_arg was fixed in core/admin-themes.php, but the add_query_arg was not fixed in core/admin-extensions.php?

see also https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html

https://ww.wp.xz.cn/plugins/wptouch/