In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute.
blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/