I have been trying to learn about XSS, more specifically, POST based XSS. But I am unsure if I actually understand how POST based XSS works.

With a GET, you can do XSS with the URL parameters, but to exploit a POST based XSS, you need to use an HTML form(it can be disguised as link tag or whatever, but, ultimately, it is an HTML form), either on your own website, or on some other website that allows HTML forms to be created, then, inside of the HTML form inputs, you hard-code the exploitable parameters.

You can auto submit the form when someone lands on your website, or the user himself can click some button, maybe there are million different ways.

All in all, is the HTML form part, the main(only?) way to do it?

Thank you!

UPDATE: There is the javascript fetch method that can do POST requests too

UPDATE 2: If I get a user on my website that auto submits an HTML form, why would I need to do the XSS in the first place? I can already execute JS on my own website