Popup plugin for Elementor · Sep 08, 2026, 11:44 PM UTC
Cleanzip2589 entriescrc-verifiedphpjavascriptpng
ZIP
5.49 MB
package size
Analysis
6 checks · 0 flagged
ClamAV 1.5.4 signature scan
3,628,051 signatures · db v28115
Undetected
ClamAV PUA heuristics
no unwanted applications
Undetected
Archive integrity
CRC verified for every entry
Valid
Path traversal (Zip Slip)
no entry escapes the extraction directory
Undetected
Encrypted content
all entries readable and scanned
None
Executable binaries
no .exe / .dll / .so / script binaries
None
Package
Plugin header
Name
Convert Plus
Version
3.5.1
Version check
Match
package and product page both state 3.5.1
Author
Brainstorm Force
Author URI
https://www.brainstormforce.com
Project URI
https://www.convertplug.com/plus
Description
Welcome to Convert Plus - the easiest WordPress plugin to convert website traffic into leads. Convert Plus will help you build email lists, drive traffic, promote videos, offer coupons and much more!
License
GPL version 2 or later - http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · modules/assets/js/ckeditor
e9187e3d86856547…
945.6 KB
JSON · framework/assets/fonts
31a99465a060b800…
586.9 KB
JS · modules/assets/js/ckeditor
c7fad990b5b09cef…
505.2 KB
JS · modules/assets/js/ckeditor
2c91157a11121970…
505.1 KB
SVG · framework/assets/fonts
9cfce94fc577dae6…
408.1 KB
JS · admin/assets/js
8b7dec42cffd125e…
335.2 KB
POT · lang
1baf3366d2257384…
282.6 KB
JPG · modules/info_bar/assets/img
a7a9fae47fd3fbb6…
263.8 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization72
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation39
eval (JavaScript)
Executes a string as code
Code execution3
new Function()
Builds a function from a string
Code execution1
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.