Vimeo: XSS when using captions/subtitles on video player based on Flash (requires user interaction)

Description The video player based on Flash not the HTML5 one, shows the captions/subtitles without escaping. This allows to upload a file with captions/subtitles with HTML code, because the content of the file is not escaped when it's stored. The way to force the use of the Flash player is using...