I currently have a xss problem in this site.

https://bbcpanningen.cupweb6.nl:1311/servlet/OMSALogin?msgStatus="><script>alert("hello")  </script>

But I don't understand how an attacker can exploit this. The sites doesn't use cookies so that might be a problem. I've read something about it, and they all said the attacker had to send a link with the xss in it.