My webhost Pantheon is reporting that this plugin has an exploit

We wouldn’t consider this vulnerability as the only users that could do what is suggested in that report are Editor and Administrator level users, both of whom would normally have the unfiltered_html capability, so they are specifically give the ability to use the equivalent of cross-site scripting (XSS). It would probably be more accurate to describe it as a bug.

If your web host thinks it is a vulnerability then they should notify the Plugin Directory about the security issue by sending an email to plugins [at] www.ads-software.com.