LPS-52311

@daledotshan 

escapeAttribute is also need for 'src' and 'title'