Can someone please tell me who I can contact to privately report a security vulnerability?
You probably should contact CS-Cart direct at…
Yes, use your helpdesk account and make the title meaningful so you don't get a “we're too busy, we'll get back to you response”.