What are the possible damages caused by a cross-site scripting attack?

What will be an ideal response?

XSS can be used with phishing to reach a broad range of Internet users in order to maliciously obtain sensitive information. Information or identity could be stolen with a simple click from a user. Every month, roughly 10 to 25 XSS security holes are found in commercial products, and advisories are published explaining the threat. XSS security holes are damaging and costly to business. Attackers will often disclose these holes to the public, which can erode customer and public confidence in the security and privacy of the company running the Web site and/or Web application.