I installed Vitepos as part of my WooCommerce/POS setup, but my security scanner (Malcare- also purchased on appsumo) has now flagged a file inside the Vitepos plugin directory as infected:

/wp-content/plugins/vitepos/vitepos/helper/plugin-helper.php

The detection was reported on June 10, 2026. Because this file is located directly inside the Vitepos plugin folder, I had to treat it as a serious WordPress security incident. I deactivated the plugin, began scanning the full site, and now have to verify whether this was a compromised plugin file, a vulnerability-related issue, or some other form of infection.

This is especially concerning because a POS plugin is not a small add-on. It sits close to WooCommerce operations, store data, transactions, and customer trust. A plugin used for sales and checkout operations has to meet a very high security standard.

At this point, I cannot continue using Vitepos until the issue is fully resolved and the site scans clean. I would strongly recommend that the developer investigate this file path, confirm whether the current release is clean, explain what may have triggered the infection warning, and provide clear remediation steps for affected users.

The plugin may have useful functionality, but security has to come first. Right now, this experience has made me pause deployment and reconsider whether Vitepos is safe enough for a live business environment.