This is an example attack scenario of OWASP for CSRF
The application allows a user to submit a state changing request that does not include anything secret. For example:
So, the attacker constructs a request that will transfer money from the victim’s account to the attacker’s account, and then embeds this attack in an image request or iframe stored on various sites under the attacker’s control:
<img src="http://example.com/app/transferFunds?amount=1500&destinationAccount=attackersAcct#“ width="0" height="0" />
If the victim visits any of the attacker’s sites while already authenticated to example.com, these forged requests will automatically include the user’s session info, authorizing the attacker’s request.
I do not understand the last paragraph though. If I log into an account on example.com and then leave the webpage without log off, and now I visit the attacker's site, does this attack work? Or in order to work, it needs that I be on the site?