Sometimes you will get a false positive on a normal plugin because a pro version has a vulnerability, like with wpdownloadmanager plugin. This is added to my TO DO list.