In this particular case it would only have the cookie data of the website.
The idea of an XSS attack is to get a website the attacker does not control to embed arbitrary Javascript code in a way that when a user opens the website that Javascript is executed by their web browser as if it were normal Javascript embedded in the website. This can be used to gain access to any data which is available to Javascript executed on that website. Javascript can only access the cookie data of the domain it is executed on (and only those which do not have the http-only flag set). It is not possible to use Javascript alone to obtain cookie data from a different domain.
Regarding what other data an XSS attack can find: It can read the content of the HTML document it is executed on. So when the html document with an XSS vulnerability also includes any other personal information, that information can be extracted and sent to the attacker.