[Pikami]

There could be an issue with the same origin policy. The policy is implemented in most or all modern web browsers as a security measure -- basically, if you are on any domain other than the one you're trying to request data from (www.cpalead.com), then it won't let you. In other words, if you are trying to host that script on any website other than cpalead.com, then it won't work. Is that the case?

It won't be the case, I used this API in my site 2 weeks ago: http://quotes.rest/
It worked, but I used fetch() instead of XMLHttpRequest