An application asks for userID and then it asks for the client certificate to authenticate. All the pages of the application are vulnerable to XFS. Now an attacker can get userID using XFS, but can it steal the user certificate too?
The private key of the client certificate does not leave the client during the TLS connection same as the private key of the server does not leave the server (see How does SSL/TLS work for more details). Thus it is impossible for the attacker in your scenario to get the private key.
As for the certificate itself (i.e. the public part). If the attacker manages to setup a server this way that it requests a certificate from the client (maybe need to configure the accepted CA) then the client will authenticate itself with this certificate (maybe asking the client first) and thus the attacker can get the certificate itself, with all the public information it contains. The same information can be accessed by any attacker passively sniffing the connection with the original server since the client certificate (i.e. the public part) is transferred in clear.