CVSS 4.0 scores User Interaction as None, Passive or Active. Active means the user makes a conscious choice to engage with the attack, such as clicking a link. Passive means the user just goes about normal activity and is hit without any chance to notice. The FIRST FAQ uses this to separate reflected and stored cross-site scripting.
The three values
- None: no user needs to do anything for the attack to work.
- Passive: limited interaction, and the user has no awareness of or ability to avoid the payload beforehand.
- Active: the user takes a deliberate action, with a chance to review what they are doing.
The test that the FAQ keeps returning to is whether the person had the choice or opportunity to review the content before interacting with it.
Clicking a link
The FAQ answers this one directly. Before clicking, an individual has the choice to review the link. Because they decide to interact with the payload, it counts as Active.
Reflected vs stored XSS
Reflected XSS needs someone to click a specific crafted link. A conscious decision is made, so the FAQ scores it Active.
Stored XSS does not need a special link. Someone browsing the site can trigger it through ordinary behavior with no warning. There is no conscious decision to engage the payload, so it scores Passive.
Same bug class, different interaction score, and so a different severity. Both still involve the same vulnerable system and subsequent system split: the web application is the vulnerable system and the user's browser is the subsequent system.
CSRF is a judgment call
The specification mentions CSRF under Passive, picturing malicious content embedded in the vulnerable application or in a trusted site the user visits regularly. The FAQ adds that in practice attackers often use links to another site carrying the malicious content.
In both cases the attacker must get the victim to view a page. The FAQ lets the analyst pick Passive or Active depending on which scenario is most likely. That means two analysts can legitimately differ, which is one reason to read the vector instead of trusting a digit.
Why this changes priority
Passive interaction usually means a larger pool of exposed users and a smoother attack, since nobody has to be persuaded. Active interaction usually adds a social step that some targets will not fall for.
That does not make Active flaws safe. Phishing works. The score is a statement about the flaw's mechanics, not about your users' habits. If your users are trained and your mail filtering is strong, you can record that on your side through Modified User Interaction in the Environmental group. If they are not, leave it alone.
A short review habit
When a finding names XSS, CSRF, clickjacking or an open redirect:
- Check whether the vector says Passive or Active.
- Ask where the payload lives. Stored in your app means Passive is plausible.
- Check whether the vulnerable code path is exposed to untrusted users at all.
- Record your reasoning in the ticket so the next reviewer sees why.
Safeguard's free scan at gold.safeguard.sh/scan checks your dependencies for known flaws of this kind and shows severity beside fix availability.
Quick check
Why is stored XSS Passive but reflected XSS Active in the FAQ?
Reflected XSS needs the user to choose to click a crafted link. Stored XSS can fire during ordinary browsing with no chance to review the payload.
Is clicking a link ever Passive?
According to the FAQ, no. The user can review the link first, so clicking is Active.
Sources
Last reviewed: 19 October 2026.
