With .html() on the text for the menu, XSS can be passed through since jQuery calls eval on the html passed through. Changed .html() to .text()