A lot of guides mention them in the same breath, but they aren't. SQL injection is far more severe, it's a remote server-side exploit that can allow arbitrary data theft or destruction by a lone attacker. By comparison, XSS is a remote client-side exploit, so (1) the hacker needs to find a victim to lure, and (2) the victim's risk profile may be more limited depending on what client side JS code can do (usually less damage than remote sever side exploit).

Not to say it's not dangerous, it is. But it's the difference between "send me an email, I'll fix it in a few days or a week", and "WAKE ME UP AT 3AM AND NOBODY GOES TO SLEEP UNTIL THIS IS PATCHED" kind of severity.