From OWASP:
Reflected XSS Attacks: Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web server. When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server.
What this means is I can put malicious code as part of the query parameters (the part of the url after the ampersand or question mark. I can send out a malicious email, use bit.ly or similar, or combine with other attacks to get you to make a unintended request, which is not filtering for the XSS.
In terms of attacks, Phishing is going to be the big one, get someone to trust my evil link. This type of attack can also be combined with CSRF or any of a number of attacks, any time and attacker can get another site to run their code, and you to run the page with javascript enabled, its going to be bad.
Some links