Actually, this is a widespread problem. And no matter if this is small or big website, it happens to get no feedback due to many reasons - no valid contact e-mail, no one is willing to fix, someone just doesn't feel like it is his duty.
Usually, there should be many e-mails for contact with person that is somehow responsible for website management. Pentesters try something like admin@..., security@..., and etc. Other possibility to get e-mail is from DNS whois. That was about case how to find contact.
If you got response, but no one fixes vulnerability during some time, then try to send second mail. Do not spam till death, but kindly remind about issue.
If no one replies and no possibility to get in touch with website representatives, well, then there are still three ways what you can do. Bad sign, but that is a problem of website owner - do they really care? So, at this point you can:
- go full disclosure - for example, post at http://www.xssed.com/;
- leave vulnerability alone;
- patch yourself - yep, break in and fix vulnerability.
Points 1 and 3 are somehow risky, especially 3, but if you do really care, things can be worse. I suppose, that's it.