I tried CSRF attacks on an XSS vulnerable form on my website from BurpSuite by generating CSRF PoC after intercepting the request, saving it in an html file and opening that file in a new tab with an active session in another tab. I found that the browser is not able to send the XSRF token automatically but it does for all the cookies and other headers.
I want to know if it is possible to create a new or manipulate the existing XSRF-TOKEN header from the client side using a script and send it with the request. Or if there is any other way to forcefully send the XSRF-TOKEN header or any other way to carry out the CSRF attack?? As of now, the only vulnerability I know of is that I am able to open my website in an iframe from other domain.