If a website accepts (safely sanitized) HTML input, and I report that it's a security issue that I'm allowed to post: <a href="https://evil.com/">good.com</a

If a website accepts (safely sanitized) HTML input, and I report that it's a security issue that I'm allowed to post: <a href="https://evil.com/">good.com</a> , how much of a response am I owed? "Yes, thank you, we're aware" seems more than adequate to me. Engaging a full-blown vulnerability disclosure process for something like this seems like a waste of time for everyone involved.