The most famous has got to be the Samy worm:
Samy (also known as JS.Spacehero) is a XSS worm that was designed to
propagate across the MySpace social-networking site written by Samy
Kamkar. Within just 20 hours of its October 4, 2005 release, over
one million users had run the payload making Samy the fastest
spreading virus of all time.
The worm itself was relatively harmless, it carried a payload that
would display the string "but most of all, samy is my hero" on a
victim's MySpace profile page. When a user viewed that profile page,
the payload would then be replicated and planted on their own profile
page continuing the distribution of the worm. MySpace has since
secured its site against the vulnerability, however certain MySpace
profiles still display evidence of the worm to this day.
There was also xssed which keeps a record of real exploits, however it appears to no longer be maintained.