Typically the more interesting types of actions on a website will be performed using POST, so an img tag or hyperlink won't be a possible attack vector in most cases, but it's still possible to include auto-submitting forms and AJAX requests to perform CSRF.