[jerf]

POSTs can be forged too, if another vulnerable site permits Javascript on their domain accidentally (among other ways, but that's the big one).

[qu4z-2]

Isn't that CSRF, though?

[smsm42]

CSRF is what allows you to post. XSS is what happens after it is posted.