title: What damage can still be done via a reflected XSS through a POST request when cookies are secure and HttpOnly?
body: <p>I'm looking at a web site that has a verified reflected XSS vulnerability in a POST operation.  I'm not sure what kind of exploit an attacker could do here.</p>
  
  <ul>
  <li><p>Cookies are all marked as secure and HttpOnly, so malicious JavaScript can't steal them.</p></li>
  <li><p>The vulnerability only shows when a POST request is done, not a GET, so the vulnerability couldn't easily be used for phishing by making a URL that starts with a legit domain.</p></li>
  <li><p>Using it to hijack the web browser to forward it to a malicious site seems unnecessary you'd have to visit a malicious site that had HTML or JavaScript code to make the browser submit the POST to the website.</p></li>
  </ul>
  
  <p>What am I missing?  Could this vulnerability still be used for nefarious purposes?</p>