Rule #1 - Don't be an asshole. You found a vulnerability in lots of sites so you contacted the vendor who was responsible for it. Cool. They replied and said t

Rule #1 - Don't be an asshole. You found a vulnerability in lots of sites so you contacted the vendor who was responsible for it. Cool. They replied and said they would fix it. Going around and e-mailing their customers is kinda odd. Sure it may result in you feeling great but in the end the customers probably don't have a clue. Better to be mature about it and contact the vendor (who actually responds!) If they stop responding or tell you to peeter off, then it might be reasonable to do some type of disclosure. But not before you actually give them a chance to respond.