Is XSS dangerous even if the cookie does not store user credentials? ...

Whenever someone talks about the dangers of xss, they mention that the 'bad guys' can get access to user credentials. But if I only store a session id on the cookie, and authenticate the user based on the session id, are there any other ways xss can be used to access user credentials?

Yes.

XSS means a foreign or malicious script is running on the page. There are a bunch of ways this could be dangerous.

Session Hijacking

Even if the cookie doesn't store user credentials (and it shouldn't). It stores enough information for the server to consider the bearer of the cookie to be a particular user (HTTP is stateless so we use cookies/sessions to remember users).

So if someone steals the session ID they can use it to impersonate you and the server might be none the wiser.

Safeguarding with IP

In your original question you asked about another level of security: verifying the IP address tied to the session. Yes, that cuts down the attack avenue. Yes, IP addresses can be faked. But you're no longer the lowest hanging fruit for attackers. At the same time security and convenience are opposites so your legitimate users might be frustrated that when their IP address changes they are no longer signed in.

Other attacks

Stealing the cookie/session is one easy way to gain access but not the only one.

Since a script is running (supposedly) from the trusted site and from the user's browser. It could to a lot of things:

loads an invisible iframe for the account edit page and resets the password/email for the user load a keylogger, show the user the login page