In most cases, sending the forged request is sufficient for the attacker as the intention is to simply trigger an action in behalf and session context of the victim. For this a simple HTML form is sufficient.
With the second version of XMLHttpRequest (XHR), the technology used with Ajax, cross-origin requests were permitted under certain circumstances defined in Cross-Origin Resource Sharing. The basic rules are that simple cross-origin requests are allowed while other require a preflight request before the actual request. That preflight is used to determine whether the server would accept the actual request. Only if that preflight request succeeds, the actual request is send.
So the conclusion is: