XSS, yes. CSRF, no, or at least not completely. You still need to know the user's username, which is better than it could have been.

This was a CSRF attack, which is mostly unrelated to XSS.