Is Group Exporter 2 safe?

Low risk

Group Exporter 2 sends the signed-in Chrome profile email to soletstalkapp.com each time the popup opens.

When the popup opens, the extension reads the email address of the Chrome profile through the identity permission and sends it in a URL query string to soletstalkapp.com to check subscription status. The reply only decides whether the popup shows its tools or a 'Please Subscribe' message. No consent step precedes the request.

So Lets Talk Digitalv1.0.0Chrome Web Store
20Risk
Who publishes it

So Lets Talk Digital - 4 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
So Lets Talk Digital
Declared legal entity
So Lets Talk Digital
Website
soletstalkapp.com/contact

Same store account

4 other listings published from this account, 2k+ users between them. 1 of them carries a finding.

LinkedIn Video Downloader816LowWAPlus Bulk Sender377LowWAPP Sender370LowWA Privacy71Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Group Exporter 2 sends your profile email to soletstalkapp.com on popup open

Code analysis shows the popup reads your signed-in Chrome profile email and sends it in a URL to soletstalkapp.com each time it opens, to check a subscription status.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open the extension popup while signed into Chrome.

The extension did this

The popup sends your profile email to soletstalkapp.com in a URL.

The reply only decides whether the UI is shown or a subscribe notice appears.

Request fields sent to the licensing host
  • Profile email
    jane.doe@example.com

    Ties the request to your Google account identity.

  • Product id
    3

    Fixed number naming the product being checked.

The code that does this

popup.js, lines 1-13 and 24-29

Readable version

Source ships unminified; shown without console.log lines.

popup.js
getUserIdentity();var email;async function getUserIdentity() {  await chrome.identity.getProfileUserInfo(function(userInfo) {    const url = 'https://soletstalkapp.com/stats/ispro';    const PRODUCT_ID = 3;    async function isSubscribe() {      const t = await fetch(`${url}?email=${userInfo.email}&id=${PRODUCT_ID}`);      const n = await t.json();      subscribe_user = n;      isUserSubscribe(subscribe_user);    }    isSubscribe();  });}function isUserSubscribe(userSubscribe){    if(userSubscribe == false){      document.getElementsByClassName('container')[0].style.display = 'none';      document.getElementById('pleaseSubscribe').style.display = 'block';    }}
Where the email goes
    • soletstalkapp.com

    Receives the profile email at /stats/ispro; appears unrelated to the waplus.io vendor domain.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Group Exporter 2 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • soletstalkapp.com

    Group Exporter 2 sends data to soletstalkapp.com. 2 other extensions we have analysed send data here.

Updated 15 October 2026makmcidbgnocbcijdifiddkbkkbjepgd