title: what's the scenario of stealing information with XSS on a POST request
body: <p>I understand the scenario of stealing information with XSS on a <strong>GET</strong> post as below workflow:</p>
  
  <ol>
  <li>Hacker identifies a page from a web application with vulnerability of being XSS injected through query string parameters.</li>
  <li>Hacker composes a url with XSS injected query string appended.</li>
  <li>Hacker sends the url to a victim, for example, by email.</li>
  <li>Victim receives the mail and clicks on the url (suppose the victim has less knowledge of security). </li>
  <li>The opened web page has XSS injected, any further action on the page could result in a security issue.</li>
  </ol>
  
  <p>This is possible because clicking on the url link will open the web page in GET mode. So, I am wondering if the page is XSS vulnerable for <strong>POST</strong> request, will it be a security issue? I could not figure out a "reasonable" attack workflow. </p>