To be 100% sure that the site is clean is to export the content via WP Admin > Tools > Export and then set up a brand new WP site and import the content there.

It’s better to check if a plugin has been compromised e.g. by checking if it contains suspicious base64_decode functions