The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.  
    (i.e. verify they are receiving your communications)

2. If no response, pass this information on to their boss. (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

You should not disclose the vulnerability publicly. In part because this may lead to a successful attack.

If all avenues fail,
I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

I think that publishing a vulnerability on your own accord is not a productive thing to do. There may be some cases where it is an appropriate last-resort, but I would highly recommend you defer the responsibilities of doing this correctly and without bias.