Example of CSRF attack for the site allowing any origin?

[voroninp]

I want to reporduce CSRF attack. For that I created an API which uses cokies for authentication and allows any origin:

app.UseCors(_ => _.AllowCredentials().AllowAnyHeader().AllowAnyMethod().SetIsOriginAllowed(_ => true));

OWASP claims (Other HTTP methods section) that CSRF attack is still possible even if forms are not involved. Yet I do not understand how it is possible without XSS.