Are you trying to get a bounty or something or just want to be responsible?

You can list them all out, with the specific pages/methods that are compromised and shouldn't get much backlash from the owners.

This is a different situation than a CVE

If you want to be paid for your efforts, I dunno :\