Cross Site Scripting can be used to
Steal cookies
Hijack accounts
Execute Flash/ActiveX contents
Force user to download s/w
All the above