Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such as a login form to steal passwords from). Both page A and page B are on the same domain.
Is it possible to exploit the XSS vulnerability on page A to run code on page B when the victim visit it, so you can steal the victims password when it is entered into the log in form?
I suspect that playing around with frames or iframes might be part of the solution here, so a natural follow up question is if it is possible to containt the XSS vulnerability to page A with the help of content security policy or something similar?