Well passive XSS, but the JavaScript code is in the POST parameters, so the victim must enter the needed code by itself?
Think it's useless...