weiser

Thanks for your feedback. Most probably we have identified the issue and will release a fix for it in the upcoming version of RLG.

Thanks – we see it now. Working on a fix already.

@jferezy please share your site URL – we’ll have a look

Hello,

Thank you for bringing this to our attention. We understand how concerning a malware warning can be, so we took the time to carefully verify this report.

We performed a local inspection and a first-pass security review of the exact file you mentioned: post-views-counter-pro-1.7.3.zip

What we verified:

• ZIP archive contains only standard WordPress plugin files: .php, .js, .css, .json, and translation files. No executables, binaries, or obfuscated payloads
• we scanned the PHP and JavaScript files for common malware patterns such as: eval, assert, system, exec obfuscation chains (base64_decode + gzinflate, atob, unescape, Function, etc.).
• no malicious code was found.
• the only base64_decode / gzinflate usage appears in class-counter.php and is used exclusively for IP hashing/encryption logic, which is expected and non-malicious

About the alert you’re seeing:

The warning shown in your screenshot is: Sanesecurity.Foxhole.JS_Zip_12.UNOFFICIAL This signature comes from Sanesecurity’s unofficial ClamAV rule set, which is heuristic-based and known to occasionally produce false positives, especially with:

• minified JavaScript files,
• ZIP archives containing compressed JS assets

This type of alert does not indicate confirmed malware and does not mean the file is infected.

If your hosting provider or antivirus software continues to flag the file, we recommend:
a) Temporarily whitelisting the plugin ZIP
b) Uploading the plugin via FTP instead of the WordPress uploader

We take security very seriously and are happy to assist further if you or your host need additional verification.

@guenni

Thanks for your feedback — it’s a valid question.

The explanation is simple: although the frontend code itself didn’t include any changes in version 1.7.1, we did modernize the frontend build process. These adjustments to the build pipeline — even though they didn’t introduce any functional code changes — affected the final output and unintentionally caused a few issues. We worked to identify and fix these problems as quickly as possible, and versions 1.7.2 and 1.7.3 focused on resolving them.

If you click any of those links it should permanently go away – that’s how it’s been designed. There must be some unexpected issue – can you please check the browser console for any information? Are you using the latest, 2.0.4 version of the plugin?

@beda1511 anything from debug log, error log, browser console errors etc.

Purge any caching plugin that you use, force refresh the admin with CTRL + SHIFT + R