I took the advice and updated the code to generate DOM nodes instead of setting HTML directly - it should decrease the risk of XSS