Well the first levels are trivial, right click "inspect element" and adding a onClick="alert();" on a random button and tadaa. I'm not sure you can qualify this as XSS attack though, can you?