We only support the latest version of Treasury available at any given time. Server owners and plugin developers are expected to use the latest version.
To report a vulnerability, please send a private message to @lokka30 on SpigotMC.org (click here).