An attacker can try to phish me with a malicious url, steal my cookies or my history etc... but does he also need my intervention or a human interaction for his attack?
The source could be anywhere there is a link for you to follow: an email, a forum, a Facebook post, Twitter, or it could be that you are already browsing an evil or compromised website.
The "human interaction" part is you following the link, no more interaction is required. For example. if there was a non persistent XSS bug on
www.example.com and you were already logged in as the site "remembers you", the link exploiting this bug could grab your session cookies from
www.example.com and send them to the attacker automatically - there is no requirement for you to do anything as the victim apart from following the original link.
Some phishing attacks wait for your browser to become idle and then transform the page in the already compromised site - there is nothing stopping them adapting the attack from phishing to XSS by redirecting you to an XSS compromised page in order to hijack your session cookies in the hope you don't notice as you haven't activated the tab in a while. The full page redirection may be necessary when the XSSed site is protecting against framed loading via
X-Frame-Options so the site needs to be loaded full page in order to be compromised.
What else he can do with non persistent XSS?