If the company you are publishing a vulnerability for is your employer, it's never a good idea to publish the vulnerability. You may be a whistleblower, but you will likely lose your job for neglecting your responsibilities.
Publishing responsible disclosure applies mainly to external party who neither has a duty to the company and whose livelihood is not dependant on the company. The main reason for responsible disclosure is because it is in the public's interest to know about the issue, as well as for taking credit for the discovery which can allow you to build a reputation/resume. However, running a vulnerability scanning tool like wpscan is not really considered an original research, there isn't really much credit to gain here.
As an employee of the company though, you really should fight this from the inside. You are part of the company and you are in a much better position than an external party to push for the resolution of the vulnerability.
How long should I wait before publishing them?
You should only publish the issue if you are ready to leave the company if the issue isn't resolved. Alternatively, if you judge that it is in the public's best interest to know about the issue, then you may want to go the whistleblower's route and publish it anyway if you think losing your job is a good enough cost for the greater good of public interest.
Although, do note that not all security vulnerabilities are of public interest. A vulnerability that simply allows users to deface the company's site, for example, are embarrassing for the company, but really serves no public benefit. A vulnerability that allows you to launch a nuclear rocket to anywhere in the world or allow the NSA to do dragnet snooping, on the other hand, would definitely be of public interest. And there are lots in between them.