CVE-2024-6485

Published Jul 11, 2024

Last updated 5 months ago

CVSS medium 6.4
Bootstrap

Overview

Description
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
Source
36c7be3b-2937-45df-85ea-ca7133ea542c
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.4
Impact score
4.7
Exploitability score
1.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Severity
MEDIUM

Weaknesses

36c7be3b-2937-45df-85ea-ca7133ea542c
CWE-79

Social media

Hype score
Not currently trending

  1. Bootstrap powers ~19% of the web. Bootstrap 2, 3, and 4 are all end-of-life — no upstream patches, and unfixed XSS CVEs stacking up (CVE-2024-6485, CVE-2025-1647, CVE-2024-6531). Only Bootstrap 5 is still supported. HeroDevs patches the rest. #Bootstrap #CyberSecurity #EOL h

    @herodevs

    15 Jul 2026

    225 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2024-6485 XSS in Bootstrap button component https://t.co/jwTsfFIINR #MicrosoftSecurity #cybersecurity

    @SecQube

    8 Dec 2025

    68 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. The Bootstrap Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `box` shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.•CVE-2026-7661
  2. Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.•CVE-2025-1647
  3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Shortcode twitter-bootstrap-collapse-aka-accordian-shortcode allows DOM-Based XSS.This issue affects Twitter Bootstrap Collapse aka Accordian Shortcode: from n/a through <= 1.0.•CVE-2025-22743
  4. A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.•CVE-2024-6531
  5. Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.•CVE-2024-6484

References

Sources include official advisories and independent security research.