Depending on the application even if it's a multiple step operation, if the operation is purely based on session/cookies it's still possible to carry out a succ

Depending on the application even if it's a multiple step operation, if the operation is purely based on session/cookies it's still possible to carry out a successful XSS attack.