This really is not the right place to post something like this. Vulnerabilities are serious business and the plugin page already has a contact email.
If you have not already done so, please contact the plugin author via the posted email there.
https://www.ads-software.com/extend/plugins/video-lead-form/
If that doesn’t work and it’s a serious matter that needs resolution then please contact plugins AT www.ads-software.com with the details. Some exploits need to be addressed sooner than later.