Plugin Hacked?

I’m hoping that you can help me? We have a client running a free version of the Enhanced Tool Tip Glossary (https://www.ads-software.com/plugins/enhanced-tooltipglossary/) and he is commenting that the plugin seems to be hacked. The hacking seems to be generating Viagra links. I am almost 100% sure that this is not caused by the plugin, though there seems to be changes to the files made randomly at times (from the WordFence pluging scan) though the changes are minor the client seems absolutely convinced that it is your plugin causing the issue. Could you confirm with me that this is not the case, also if there is a possibility that this is happening through another plugin would the pro version fix any issues that they might be having with the free plugin to do with hacking etc?