If you're talking about potential XSS attack on their website (https://bitcoincore.org/), you could mention it on their GitHub repository (https://github.com/bitcoin-core/bitcoincore.org/issues).