Reflected XSS on vimeo.com/musicstore

How it was found

Description

The value of the parameter section is reflected in the Javascript function MusicStoreCommon.initialize() without escaping, which allows to insert Javascript code.

Proof of concept

1. Go to https://vimeo.com/musicstore?section=%27-alert(document.domain)-%27.
2. alert(document.domain) is executed.

This reflected XSS is reproducible on Chrome, Safari and Firefox.