Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes

Description

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin.

Recommendation

No fix is available yet. Followings are affected versions:

>= 1.4.0, <= 3.4.1

References

GHSA-vxmc-5x29-h64v
www.herodevs.com
lists.debian.org
CVE-2024-6485
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes and gives you actionable findings to investigate.

Start a free scan

Related Issues

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability - CVE-2024-29271
ghtml Cross-Site Scripting (XSS) vulnerability - CVE-2024-37166
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

See something that needs correcting? Let us knowUpdated November 03, 2025