The attacker can send a link containing a malicious URL to a victim, which can perform actions such as stealing the victim's session token or login credentials. It also allows the attacker to inject malicious code into the website, giving them the ability to steal sensitive information, manipulate data, and launch additional attacks.