A Cross-Site Scripting (XSS) vulnerability exists in Bootstrap's button plugin related to the data-loading-text attribute. This flaw allows an attacker to inject malicious JavaScript code into the attribute, which executes when the button enters its loading state. The vulnerability affects Bootstrap versions from 1.4.0 through 3.4.1.