I bought a plugin from JVzoo that accomplishes in 30 seconds what takes me an hour. No brainer, right? However, I do "it" the legal way while the plugin does "it" the shady, probably illegal way. Let's say push comes to shove and the illegal tactics are discovered. Who will ultimately be sitting in the defendants chair? Sure, ignorance isn't a defense - however I would expect a plugin with hundreds of sales to not want to implicate their buyers.
With the limited information supplied I would say that both parties would be open for prosecution. However the enforcing organisation would in all probability prioritise and prosecute the originators in the first instance.
My guess would be that you would be directly responsible for the wrong-doing and would then be expected to pursue the plugin developer for putting you in the situation - lucky you! two sets of legal fees