I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in pressuring the organization to fix the vulnerability. After that, the vulnerability would just linger around, increasing chances a "black-hat" hacker would exploit it. That's the opposite of what I'm trying to accomplish.
I'm pretty far in the "responsible disclosure" process. I'm trying to behave very ethically here.
If it were a vulnerability in something as big as Facebook or Google or so, than this would be picked up quiete easily by security blogs I think, possibly even general tech press. This site is definitely more "second tier", which makes for less juicy news. Also, I don't feel like taking time to write an exploit (say: a worm, perhaps capturing user cookies along the way), which I assume would enhance the news-value. I'm actually surprised how much time I put into this already, somewhat "proving" that I care to myself. (never been in a like situation before)
I'm fully aware that this question is "subjective" (it's even be automatically detected as so), but I'm still gonna try my luck, 'cause I really could use some help here.
Note, I tagged this with "vulnerability-markets" because I think that this is somewhat related. I'm not looking to sell it though. I just want to see it fixed.
Thanks in advance. :)
Perhaps I should have made it more clear that as it stands now, I don't have much faith in the organization's desire to fix this vulnerability, without external pressure. That's why I'm exploring my options.