XSS occurs when a piece of browser scripts origin from 3rd-party sources be injected into a vulnerable website's content, which can be considered as instructions to the user's browser to "present" a website. In web's terminology, the user's browser believes that such instructions are legitimate within the web site domain. In XSS scenario, the returned contents contains injected scripts are not actually what the website wants (therefore "cross-sited"), but the browser still thought that are legitimate and follow the instructions (including executing the injected browser script).
Therefore XSS attack is "exploiting user's browser's trust on the content returned from a vulnerable web site".
CSRF occurs when a request can be triggered by 3rd-party to be sent from a victim user's browser to the vulnerable website and be processed. This is possible because from the web site's point of view, the request is appearing to be legitimate (sent from user browser -> possible to contain necessary cookies). Similarly to XSS, in current web's terminology, the a web sites believes that all requests sent from a valid user browsers are legitimated actions that really "initiated" by the user (e.g. clicking the desired button), but it's not.
Therefore CSRF attack is "exploiting trust of a vulnerable website on the requests submitted by a victim user browser". (Which is actually the opposite of XSS)
XSS and CSRF are often mixed up because in many scenario, CSRF is exploited via XSS vulnerability - but having XSS condition is not a necessary condition for CSRF