There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a similar attack?
Here is a good overall reference http://cwe.mitre.org/data/definitions/79.html
So the issue is related to neutralizing data input into web pages.
Of course, we now live in the internet era, so, there's a video for that!
It is almost 10 minutes long, complete with all the details you would like, reviewing the exploit code and its functionality.