Fix: XSS vulnerability

Only plain text allowed in title attribute, use embedded span.title for advanced html tips (raw html is been returned by $.attr(“title”) and thus unintentional XSS vulnerability is possible)