An interesting paper by p3lo concerning the new XSS vectors, javascript malware obfuscation , url cache poisoning, packing, frame jacking techniques etc..  

An interesting article about an xss vulnerability in a theme that was installed on wordpress.com.

How to write a XSS (cross site scripting) worm for McCodes sites

(IN)SECURE Magazine Issue 17, includes Russ's article about open redirect vulnerabilities. Covers them in detail by providing info on real-world examples, prevention solutions and the relation with PCI-DSS standards.

In this tutorial paper, Gerasimos describes in full detail how to perform  an XSS filter invasion and run his JavaScript key logger in order to steal user names, passwords and user credentials.

In this tutorial paper, Gerasimos Kassaras provides useful insight into how to defend against cross-site scripting with .NET.

An interesting paper on how to use various obfuscations for XSS filter evations to inject JavaScript code.

This text lists useful Firefox add-ons to use for website vulnerability assessments.

This  paper was written back in 2003 and includes a very good description of what cross-site scripting is, methods of injection and filtering and a section titled "Inside the mind, mental walk along of a XSS hack".

Russ's latest toolsmith column for ISSA Journal is a very interesting read about cross-site scripting.