Teh Cookie Monster. A full example of how XSS can lead to full account takeover.
Mocking the Military; Hacking Hackers
I found a way to add pages to the U.S. Department of Defence. Of course I took the piss. Also, hacking hackers bonus content.
Stored XSS in several nationwide UK newspapers. One XSS to rule them all.