CVE-2024-6485

XSS in Bootstrap button component

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

We have discovered 631,968 live websites that are affected by CVE-2024-6485.

Run a Free Instant Scan



Affected Software

Product  Bootstrap
Category UI Frameworks
Vulnerable Domains631,968 live websites (40% of Bootstrap install base)
Vulnerable Versions
  • from 2 through 3.4.1
Vulnerable Versions Count79 versions ( 34% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 11, 2024
  • Updated - Nov 3, 2025

Credits

  • K (finder)

Website Distribution by Country

Number of websites using CVE-2024-6485
United States242,331 websites


Germany40,225 websites
France27,865 websites
GB23,445 websites
Netherlands22,835 websites
Cyprus19,835 websites
Russia17,782 websites
Brazil16,823 websites
Italy15,722 websites
Japan14,719 websites

Website Distribution by TLD

Number of websites using CVE-2024-6485
.com282,371 websites
.org31,320 websites
.de21,736 websites
.net20,779 websites
.co.uk17,123 websites
.nl15,764 websites
.com.br15,351 websites
.ru14,808 websites
.it11,630 websites
.fr11,212 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-6485

Top websites that are affected by CVE-2024-6485. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com United States***
******.com United States***
**.com Singapore***
*********.com Canada***
*****.******.com United States*,***
****.org France*,***
*******.com United States*,***
************.com United States*,***
****.io United States*,***
***.cn China*,***
See full domain list

FAQ

CVE-2024-6485 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Bootstrap
A total of 631,968 websites have been identified as vulnerable to CVE-2024-6485, based on global website indexing conducted by WebTechSurvey.
The Bootstrap is affected by the CVE-2024-6485 vulnerability.
Bootstrap versions up to and including 3.4.1 are vulnerable to CVE-2024-6485.