The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.  
    (i.e. verify they are receiving your communications)

2. If you do not get a satisfactory response, pass this information on to their boss.  
    (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

If all avenues fail,
I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

You should not disclose the vulnerability publicly.

- This may lead to a successful attack by individual(s) with poor intention.
- In many jurisdictions, there are legal consequences that companies can impose on individuals in your position.
- Such publication can promote a poor balance of responsibility between the attacker and the defender.

I concede that there may be cases where it is right to publicly disclose a vulnerability, but I would highly suggest you defer such responsible, careful, and unbiased handling to a public service that is more experienced in such matters.