Look in linkedin for people working in security for that company, and invite them to connect. In the connection message state directly the problem. Do this wit

Look in linkedin for people working in security for that company, and invite them to connect. In the connection message state directly the problem. Do this with technical people, but also with it managers from the company and its worth sending it to the CEO. Explain what are the risks (is it persistent xss visible by other users in a forum etc) These things are only important until some manager says they are important, so try to explain the business and public image risk of the exploit to a high level manager via linkedin in non technical terms, ideally with a demo. If they forward the email to the it department i bet that then they would act. Last case if responsible disclosure doesnt work after 3 /6 months: public disclosure via some news site. All of the sudden it gets fixed in two days, they end users end up being better off in the long term. Unpatched exploits that stay there for years are the bread and butter of hackers, and the short term risk introduced by the public disclosure is compensated by the fact the users get protected in the end.