XSS on player.vimeo.com without user interaction and vimeo.com with user interaction

How it was found

I reported this one in the report #87854, but I was asked to report it again in a separate report.

Description

At the end of each video appears the thumbnail of other video from the same user. This thumbnail has the title More from [name_of_the_user]. The problem is that the name of the user is not escaped, which allows to execute Javascript code. There is a limit for the length of characters that you can use for the name of the user, but it's enough to exploit it. The way I used for the proof of concept is setting the window.name to the Javascript code, and then put <svg onload=eval(name)></svg> as the name of the user.

Proof of concept

1. Download the file name_xss_iframe.html that I attached.
2. Wait 10 seconds.
3. prompt(document.domain,document.cookie) is executed on https://player.vimeo.com.
4. Download the file name_xss.html that I attached.
5. Click on Watch video.
6. Click on the button to play the video.
7. Wait 10 seconds.
8. prompt(document.domain, document.cookie) is executed on https://vimeo.com.