I think the name “cross site” is confusing. It’s easy to hear that and think it involves code on one website attacking code on another website. That’s not what it is. Not to mention its unfortunate “true” acronym.
If it can access cookies, then it can access active sessions.
If it can access active sessions, it can log in as you to websites you are logged in to, at least long enough to change passwords or other havoc.
Symantec has said that 80% of internet vulnerabilities are due to XSS.
Read More at : http://css-tricks.com/what-is-xss/