I've just read an article about CSRF and it mentions 3 attack vectors; XSS, Manipulated Links and a local exploid.
Whereas the last two methods seem to be possible (for me), I'm quite unsure, how XSS will play a role here.
Based on my understanding that I'd like to exploit a website through a victim, I see no option how I can use XSS here. I could only understand how to do it if I'm the one that does the XSS, but in this case I wouldn't need a victim, would it?
The only option I can think about is a spoofed URL with the Payload as Parameter, but that would be vector 2 already.
Edit: Now I think I have a clue; the attacker would create a persistent XSS that is triggered, when a (any) victim visits the legitimate site.
Is this idea correct?