XSS vulnerabilities enable attackers to inject malicious scripts into web pages viewed by other users. The primary impact is session hijacking - by stealing cookies or session tokens through injected JavaScript, attackers can impersonate legitimate users and gain unauthorized access to their accounts.