I have found an XSS vulnerability on a website where, upon user input in a search box, the webpage displays what the user is typing unfiltered/unsanitized. The user can input anything like <script>alert(1)</script>, or <a href onmouseover=alert(1)>link</a>, and the webpage runs the code. However, when the user searches this, the search is not reflected in the URL of the webpage. When the user searches something, the URL remains unchanged.. Is there a way that a vulnerability like this could be weaponized/exploited? This is for penetration testing and I have full authority/permission to do this. The webpage and HTML look like the following:

Results for
Search: this is what the user searched, this is unfiltered.

<Span>Results for</span>
" Search: "
<pre>this is what the user searched, this is unfiltered.</pre>

...

Results for
Search: [link]

<Span>Results for</span>
" Search: "
<pre>
    <a href onmouseover=alert(1)>link</a>
</pre>