XML is not a programming language, but a markup language. It is just used to store data to be used by the C++ and Python code. The data from the XML is stored by the game when it loads, so changing the files has no effect until you close and reopen the program.
(IIrc, xml technically can be used as a real programing language, but that is rare. In Civ IV, the only real xml programing is in the ls system, used to control some graphics. That is often considered the hardest code the game uses, and I don't know anyone who dares to touch it. Some may consider the XML schema used to let the DLL read the xml coding, but that is a bit of a stretch. The way xml is usually used it is the easiest thing to mod.)
Most of the game's real code is in the Software developer Kit (SDK), which is written in C++. There are a lot of C++ files, which are often very long and very interdependent. The SDK allows you to change almost any aspect of the game, apart from a few things that are hard coded into the game engine, dealing with things like graphics, terrain elevation, the difference between water, land, and peaks, etc. The SDK files cannot run on their own, but must be compiled together into a single DLL file. The DLL is a binary file which cannot be uncompiled, so editing ti requires access to the source code.
Python is one of the simplest real computing languages. It is practically pseudocode. One annoying thing about it is that it is highly dependent on white space. It is a rather high level language, which makes it really show when compared to C++. It has the advantage of not needing to be compiled, so things coded in python can be changed easily. Civ IV is designed to let you edit python while the game is running, reloading all the python files whenever one of them is saved. unfortunately, the game generally fails to reload the python files that did not exist in the unmodded game. That means that saving a python file while in the middle of the game will mess up the interface and disable things like python spells. You can still save the game though, and then restart the program to get it working properly again. Many things in the SDK are outsourced to python, and python can call many special SDK functions that would not be called otherwise.