Create Sign and send bitcoin transaction using HD wallet
To spend any coins, you’ll need the private key corresponding to that bitcoin address. 

In the case of an address derived from an xpub, you’ll need to use the xpriv that created the xpub to derive the child privkeys (they’ll be the same child pubkeys that the xpub derived, but this time you’ll have access to both child privkeys and pubkeys). As you know, it is not possible to derive the child privkeys from an xpub itself.