if the xml api doesn't support cors , you have to use jsonp.
im guessing that since they are still on xml, that they aren't modern enough to support json or cors...
you can reroute the xml into JSON using YQL/PIPES for free, or setup your own server proxy on a paid server plan that support asp/php.
search 'cross domain ajax proxy' to find some server code for such a task.
BROWSER STATS [% share]
(2013/10/31) IE7:0.5, IE8:8.6, IE9:5.3, IE10:12.3, FF:17.7, CH:41.8, SF:8.1, MOBILE:20.4