Maven is a build tool, it does not control your dependencies at runtime (i.e. when the application is already running). So this is not a maven issue, hence maven is not the place to look for the solution.
If you have no control on the hosting application but only on your plugin, then you have no choice rather than use the same versions of the dependencies your plugin and the application have in common.
If you own (control) both the hosting application and the plugin then you need to handle the plugins correctly. It is easy to say, but harder to do...
You should look for existing frameworks that already solve it for you.
Some examples are: OSGi, JPF, PF4J, and there are more...
Also, take a look in the following SOF question: Best way to build a Plugin system with Java
In a nutshell-
This is a classical issue of supporting plugins in an application.
The best solution, in my opinion, is to isolate the plugin from the hosting app. This can be achieved using different class loaders and of course - reflection.
Your application is running and its classes are loaded in the "regular" way - nothing fancy here. But, in order to isolate the plugin's code from your application's dependencies at runtime, you need to load the plugin classes and dependencies using a different class loader (e.g. a URLClassLoader
). It is very important that this class loader does not have your application's class loader as a parent, otherwise you will still face the versioning issue with conflicts (as you have now).
EDIT:
Another option for handling this situation when you only have control over your plugin-
You can, for example, write your own class loader and use it in the entry-point of your plugin (so that all plugin classes except for the entry-point are loaded using this class loader). To do this you need to write the class loader in a way that it first tries to load a class from your plugin jar and then delegates to its parent loader. This is feasible (and actually not too difficult) but is going against the class loaders contract (first delegate to parent, load by yourself only if not found).
I still think it is much better and more robust to make sure to use the same dependencies, specially when the application has a newer version...