Wordpress Plugin Compromised

I downloaded an word press plugin from EElements and noticed that a new user was created in word press, I deleted the user and am getting the whole site setup net new because I don’t know what files or data has been changed.

Do you guys install and verify these plugins and their sources…