Automattic/_s — pull request #497 by developdaly (2014-05-23 19:41:47+00:00)
Title: Adds escaping

bloginfo() is not escaped in several places and though it is escaped
for HTML in the function it does not properly escape for use within an
attribute.
See for further explanation
http://wordpress.stackexchange.com/a/80449/3293
props @nickdaugherty