An attacker might be able to steal the user's account session cookie if they are using a very severe XSS problem. Getting access to cookies means allowing the fraudsters to get your login information, info about location, device, browser used and some personal details. Another common target of XSS attacks is redirecting the user to an exploit page, where it receives malware through browser vulnerabilities. And that will not be a “soft” adware or browser hijacker - exploit pages usually used to deploy spyware, ransomware or an advanced persistent threat.