It's not exploitable in itself, but it's a potential escalation path for an attacker to go from cookie fixation to full XSS.
If the site is running on a hostname that has neighbour domains, any XSS attack on those neighbours means a cookie can be written to the shared parent domain, escalating to an XSS attack on the site. eg. from
untrusted-uploads.example.com they can write a cookie with domain
example.com, which will be read by
If the site is running on
https://www.example.com/, an attacker can still spoof a site at
http://www.example.com/. Any cookie set from there will be readable from
https - script at
https would not detect that the cookie was not created with
secure. So cookie-XSS makes HTTPS ineffective (except where foiled by Strict Transport Security, but that's not a complete defence).
It's not really possible(*) for a script (either server or client side) to detect that the
httponly flags on the cookie match the values expected, which means you can't reliably detect injection of cookies from outside your site.
(*: there are potential hacks where you attempt to override a cookie by setting a new one with the flags you want, but ultimately it's not completely reliable as the attacker script could be running at the same time.)