TranslateSense – AI Translation for Polylang

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

• Proper nonce verification on all AJAX handlers using check_ajax_referer()
• Capability checks (current_user_can) implemented correctly on all admin operations
• All database queries use $wpdb->prepare() with typed placeholders
• Output escaping is consistent (esc_html, esc_attr, esc_url, wp_kses_post)
• Input sanitization follows WordPress standards (sanitize_text_field, sanitize_key, absint)
• ABSPATH checks present in all PHP files
• External API calls use wp_remote_post/get with proper error handling
• REST API endpoints implement permission_callback correctly
• No SQL injection vulnerabilities identified
• No XSS vulnerabilities identified
• Proper use of WordPress coding standards and PSR-4 autoloading
• Feedback form data transmission is opt-in and clearly disclosed
• Consistent use of 'permission_callback' for all registered REST routes.
• Redaction of sensitive API keys in 'get_settings' and 'update_settings' responses.
• Strong input sanitization using 'absint', 'sanitize_key', and 'sanitize_text_field' across REST arguments.
• Proper use of 'wp_json_encode' and 'wp_check_invalid_utf8' for translation data normalization.
• Usage of 'rest_authorization_required_code()' for correct HTTP status codes in permission errors.
• XXE properly mitigated in XML parsing: DOCTYPE rejection plus LIBXML_NONET and libxml_use_internal_errors with restoration in Base_Builder::extract_section().
• The single custom SQL query (Reference_Resolver::bulk_validate_attachments) uses $wpdb->prepare() with %d placeholders and a literal %s for post_type; table name is $wpdb->posts (server-side constant) — not injectable.
• Translate::sanitize_string() enforces structural tag-signature matching between source and translated HTML and escapes translated text nodes with esc_html(), preventing AI-generated markup injection.
• Recursive parsers (blocks tree, attribute values, reference extraction, array replacement) all have depth caps (100/20/30/30), guarding against deep-nesting resource exhaustion.
• All PHP files include the ABSPATH direct-access guard.
• DOMDocument fragments are never serialized back into Gutenberg content; the code patches the original source by offset mapping, avoiding parser-mutation injection of closing tags.
• Input identifiers are normalized with absint()/sanitize_key() throughout (attachment IDs, language slugs, provider keys).
• Internal link replacement uses esc_url()/esc_attr() when rewriting href/src/srcset values.
• Media translation never auto-creates attachments and validates post type/status before mapping IDs, avoiding unintended object writes.
• Statistics updates use an in-memory request_id deduplication guard against double-counting.
• :
• REST requests use the X-WP-Nonce header via wp.apiFetch/fetch fallback — WordPress's official REST CSRF mechanism.
• React's default escaping is used for nearly all rendered content; raw HTML injection is limited to three identifiable sinks.
• Polling loops include re-entrancy guards (he.current/u.current) and cleanup on unmount/close, avoiding runaway timers.
• Job expiry handling (24h) and abort-controller management are implemented client-side.
• No hardcoded secrets, eval(), or direct innerHTML assignment of user input found in the JS bundle.
• External links consistently use rel="noopener noreferrer" with target="_blank".
• React createElement is used consistently for all DOM construction, providing automatic XSS protection through proper output encoding
• API requests implement WordPress REST API authentication via X-WP-Nonce header in both wp.apiFetch() and fetch() fallback paths
• The CSS file contains no dangerous constructs such as expression(), javascript: URLs, or inline event handlers
• External links use rel="noopener noreferrer" to prevent tabnabbing attacks
• User input in form fields (API keys, custom prompts) is stored in React state without direct DOM injection
• The API helper implements a graceful fallback from wp.apiFetch() to standard fetch() for compatibility
• Disabled buttons use proper HTML disabled attributes rather than just CSS classes, ensuring accessibility and preventing accidental activation
• SVG icons use currentColor for stroke, allowing proper theme integration without hardcoded colors
• CSS implements proper focus-visible states for keyboard navigation (e.g., .ts-review-search-wrap:focus-within)
• Animation keyframes are namespaced (tsShimmer, tsSpin, tsFadeInOverlay) to avoid conflicts with other plugins or themes
• All REST requests consistently attach X-WP-Nonce (WordPress's official REST CSRF mechanism) and prefer wp.apiFetch when available — the documented, correct pattern.
• Translated content is written into the Classic Editor via textarea.value and TinyMCE setContent()/fire('change') rather than raw innerHTML, avoiding direct HTML injection sinks.
• HTML entity decoding uses the safe textarea technique (no innerHTML rendering of decoded content), and attribute replacements are explicitly escaped via escapeHtml() before splice.
• The review table uses contentEditable="plaintext-only" with a paste handler that strips all markup (insertNode of text node), preventing paste-based HTML injection into the editing surface.
• Extraction logic properly excludes non-translatable tags (script, style, iframe, svg, etc.) and shortcodes, reducing the attack surface for content corruption.
• URL/email masking before sending text to external AI providers (maskUrlsAndEmails) limits unnecessary disclosure of sensitive strings to third-party translation APIs.
• AbortController-based cancellation for in-flight translation requests is properly tracked and released.
• localStorage editor-open flags carry expiry timestamps and are pruned on read — good hygiene for cross-page state.
• Autosave-before-navigation flow explicitly verifies tickData.wp_autosave.success rather than assuming heartbeat tick means success, and cleans up listeners on all paths.
• All REST API calls use the X-WP-Nonce header with the wp_rest nonce — WordPress core's documented CSRF mechanism, requiring no custom handling.
• Feedback AJAX form submits a nonce field and the payload contains no sensitive data beyond reason/message/diagnostics flag.
• Chrome AI guidance builder consistently escapes every interpolated value through escapeHtml() before HTML assembly.
• No API keys, secrets, or credentials appear in any audited file — AI provider keys are correctly kept out of client code.
• Recursion depth guards (depth > 50/100/200) in block traversal and value-resolution functions prevent stack exhaustion.
• Prototype check in translateResolveValue (only plain objects cloned) prevents prototype-chain traversal of foreign object types.
• DOM updates for meta fields use value assignment plus native input/change events — no innerHTML injection sinks for translated content.
• CSS file contains no executable content and includes accessibility-conscious touches (focus-visible outlines, prefers-reduced-motion).
• Token-aware batching and concurrency limits in the AI runner show thoughtful resource management.
• readme.txt includes a proper External Services section documenting OpenAI, Gemini, and vendor data flows — good wp.org hygiene.
• Text domain 'translatesense' is used consistently across all translation calls; no mixed domains found.
• error_log() calls in class-ai-connector-bridge.php are consistently gated behind defined('WP_DEBUG') && WP_DEBUG.
• Feedback form is consent-gated: admin email / site URL / WP version / PHP version are only transmitted when the user explicitly checks a diagnostics checkbox, and the endpoint is documented as contacting feedback.dragwyb.com with a privacy policy link.
• Bulk_Process correctly uses $wpdb->prepare() for all user-supplied values and $wpdb->prefix for the table name; no raw concatenation of user input into SQL.
• Bulk worker uses MySQL GET_LOCK/RELEASE_LOCK advisory locks and a try/finally block to release the lock, preventing concurrent worker collisions.
• Bulk worker pauses when PHP memory usage exceeds 80% and honours a time budget, showing good production-host awareness.
• AI and legacy provider calls wrap wp_remote_post in is_wp_error() checks and return WP_Error objects consistently.
• translate_via_wp_core() uses try/finally to remove the temporary 'wp_ai_client_default_request_timeout' filter, avoiding filter leakage into subsequent AI requests.
• Both activation and deactivation hooks are registered in the main plugin file via register_activation_hook()/register_deactivation_hook().
• Plugin headers include License, License URI and Domain Path, and declare strict_types=1 across all PHP files.
• AJAX feedback handler verifies both capability (manage_options) and nonce before processing.
• Every reviewed PHP file starts with an ABSPATH guard.
• Activator uses dbDelta() for custom table creation rather than raw CREATE TABLE execution.
• Deactivator clears all three plugin cron hooks.
• Custom database queries use $wpdb->prepare() with placeholders in the reviewed files.
• The plugin uses WordPress HTTP and option APIs rather than reinventing core infrastructure.
• Classic_Builder and Dom_Filter restore libxml error handling with try/finally.
• Bulk_Translate localizes REST URL and nonce correctly for the React app.
• No dynamic properties without #[\AllowDynamicProperties] were found.
• No utf8_encode()/utf8_decode() usage was found; mb_convert_encoding() is used where needed.
• Text domain usage in PHP output is consistent with the 'translatesense' domain.
• Every file opens with a proper `if ( ! defined( 'ABSPATH' ) ) { exit; }` guard and `declare(strict_types=1)`.
• All dynamic SQL uses `$wpdb->prepare()` with correct placeholders; interpolated table names are pre-escaped via `esc_sql()` and annotated with targeted phpcs:ignore comments rather than blanket suppression.
• Recursive scanners in Detector are bounded by explicit depth (25 / 10 / 15) and node (2000) caps — no unbounded recursion risk on hostile block/Elementor trees.
• Polylang_Synchronizer wraps all internal Polylang calls in try/catch(\Throwable) and removes its scoped filters in a `finally` block, so an exception can never leave `pll_copy_post_metas` / `pll_copy_taxonomies` globally mutated.
• Sync filters are scoped to the exact source/target pair via `is_active_pair()`; the code explicitly does not register permanent global Polylang filters (a common source of cross-request corruption in similar plugins).
• Retention policy exists: 30-day translation purge, 10-day package purge, plus orphaned-string cleanup hooked to `before_delete_post` — data does not accumulate forever.
• Custom tables use `Hashing_Db::cleanup_unused_strings()` and `delete_post_packages()` for real cleanup, and no `switch_to_blog()` is used without a matching `restore_current_blog()` (there is no switch_to_blog at all in these files).
• Text domain `translatesense` is used consistently across all five files; `esc_html__()`, `esc_attr()`, `esc_url()` and `wp_kses_post()` are applied at output points, including inside the generated XML snippets.
• No `error_log()` calls, no `var_dump()`/`print_r()`, no `@` suppression, no `wp_die()` on frontend paths, and no external HTTP calls left unchecked within these files.
• REST permission callbacks are explicit and per-endpoint, with post-scoped capability checks (edit_post) rather than blanket manage_options, and translate-batch verifies each submitted string belongs to the source post before consuming AI credits.
• Sensitive provider secrets are masked in REST responses via mask_api_key() and a recursive redact_sensitive_values() helper.
• Request payloads are bounded (500 strings, 1MB translation payload, 100 posts × 50 languages) and normalized through normalize_translation_value() with depth limits, avoiding unbounded recursion.
• Classic_Builder safely applies offset-based replacements back-to-front with overlap/range validation rather than naive string replacement.
• Elementor tree recursion is depth-capped (100 / 20), and the plugin degrades gracefully when Elementor/Polylang classes are absent via class_exists()/did_action() guards.
• declare(strict_types=1) and consistent 'translatesense' text domain usage throughout.
• Every one of the 13 files opens with the `defined( 'ABSPATH' ) || exit;` guard and declares `declare(strict_types=1)` — consistent, modern baseline.
• The Gutenberg builder deliberately avoids serialising a DOMDocument back into Gutenberg innerContent fragments, patching the original source string instead; this is a genuinely hard problem handled with unusual care (ordinal-based text-node and attribute mapping, conservative 'never guess when the fragment occurs more than once' fallback).
• translate_string()/sanitize_string() implement a sound defence: for plain-text sources AI-introduced HTML is stripped, and for HTML sources the original tags are preserved while only text nodes are replaced, with tag-signature comparison before any substitution.
• Deep recursion is bounded defensively throughout (depth > 100 in block trees, depth > 20 in attribute schemas, depth > 30 in reference collection/replacement, depth > 200 in the HTML tokenizer).
• Reference_Resolver::bulk_validate_attachments() chunks attachment IDs (100 per query) and uses $wpdb->prepare() with generated %d placeholders, with explicit phpcs annotations for the direct query — correct handling of the parameter-limit problem.
• The internal-link pipeline is structured as single-responsibility collaborators (collector / resolver / replacer / cache) with a shared runtime cache, negative-result caching, and explicit no-auto-create policy for media translations.
• Statics::update_translation_statistics() writes with `update_option( $opt, $stats, false )`, correctly avoiding autoload bloat.
• No error_log(), var_dump(), print_r(), trigger_error(), or PII (emails/IPs) logging appears in any audited file.
• `uninstall.php` includes the mandatory `if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) exit;` guard at the top
• WP-Cron hooks are cleared via `wp_clear_scheduled_hook()` on uninstall rather than being left tick-able
• XXE posture is strong: every XML entry point uses `LIBXML_NONET` and explicitly rejects `<!DOCTYPE` declarations (`stripos( $xml_string, '<!DOCTYPE' )`)
• All PHP files declare `declare(strict_types=1)`, minimizing silent type coercion
• Multisite awareness exists inside `Xml_Engine::get_active_plugins_list()` where `get_option('active_plugins')` is correctly merged with `get_site_option('active_sitewide_plugins')`
• Text domain `translatesense` is used consistently across every `__()`, `_e()`, and `esc_*__()` call in the audited files
• Method signatures use explicit nullable return types where appropriate (`extract_widget_snippet(): string|null`), avoiding PHP 8.4 deprecation on implicit nullable
• Transient caching (`DAY_IN_SECONDS`) is applied both to the merged XML blob and to the per-builder extracts, and `invalidate_transients()` is wired to `activated_plugin`, `deactivated_plugin`, `switch_theme`, and `upgrader_process_complete` for cache-freshness
• `SimpleXMLElement` counts are guarded with `count( $field_node->field ) > 0` before iteration, so empty-node cases don’t raise deprecation warnings
• No external CDN, Google Fonts, or analytics pixel is loaded; the CSS is fully self-hosted with a system font stack, avoiding the most common wp.org/GDPR complaint.
• WordPress-native primitives are used where possible: the REST helper transparently prefers `window.wp.apiFetch` with a `/translatesense/v1/` path and only falls back to raw `fetch`, correct `X-WP-Nonce` header handling, and the `wp.element` root is created once and cached on `_tsReactRoot` to prevent double-mounting.
• `AbortController` instances are tracked in a `Set`, released on completion, and `abortAll()` guards each `abort()` in a try/catch — cancellation during navigation is handled rather than leaking listeners.
• Polling timers are stored in refs and cleared on unmount (`fe()` / `f()` teardown) and the bulk-action click listener is properly removed in the `useEffect` cleanup, so re-opening the modal does not stack handlers.
• `useEffect` hooks that fetch on mount use an `e = true` flag and bail out on cleanup, avoiding the classic setState-after-unmount React warning.
• Order-of-operations safety: the on-device Chrome AI path marks each job `running`/`completed`/`failed` through `bulk-update-job` so a partially completed batch is recoverable, and job age is checked (`Date.now()-created >= 864e5`) before starting, with an explicit "job expired" failure state rather than silent stalling.
• Error surfaces are at least present and structured (`TSErrorModal`, per-row `failed` status with a click-through detail button, `filterOnlyFailed` toggle) rather than being swallowed — the underlying data flow just needs the hardening noted above.
• CSS ships responsive breakpoints at 1120/782/480 px and uses `prefers`-free, motion-only animations, keeping the admin UI usable on mobile.
• All external links rendered by the dashboard header and promo sidebar carry `rel="noopener noreferrer"` together with `target="_blank"` — no reverse-tabnabbing exposure.
• REST requests are authenticated via the `X-WP-Nonce` header (both through wp.apiFetch and the hand-rolled fetch fallback), so the dashboard does not rely on cookie-only auth.
• The method-selection radiogroup implements proper ARIA (`role="radiogroup"`, `role="radio"`, `aria-checked`, `aria-controls`, `aria-labelledby`) plus Arrow/Home/End keyboard navigation and correct roving `tabIndex` — genuinely accessible, not just decorative.
• Modal overlays include labelled close buttons (`aria-label="Close"`), and the tab bar is wrapped in `<nav aria-label="Dashboard Tabs">`.
• CSS uses logical properties (`padding-inline`, `margin-block`) alongside `object-fit`, which gives reasonable RTL readiness for a plugin aimed at multilingual sites.
• Destructive cache-clearing actions are gated behind an explicit confirmation modal that states the record count and warns about irreversible token cost — good destructive-action UX.
• Fetch/API calls are wrapped in try/catch/finally throughout the dashboard, with loading state correctly reset in `finally` blocks so the UI does not deadlock on failure.
• The dashboard is mounted defensively (guarded root lookup, `_tsReactRoot` singleton check, and a `document.readyState` check before mount), avoiding double-render when scripts load twice.
• Provider abstraction supports registration, enable/disable, availability checks, and abort controllers.
• Editor adapters are separated into classic, Elementor, and modal-specific modules, which keeps responsibilities reasonably clear.
• Classic editor translation preserves HTML structure by extracting units with character offsets and applying replacements from back to front.
• localStorage flags include expiry timestamps and cleanup of stale entries.
• CSS uses design tokens and responsive provider-grid behavior rather than one-off styles throughout.
• The UI includes progress, error, provider-selection, and review modals that give users meaningful feedback during long-running translations.
• readme.txt documents every external service (OpenAI, Google Gemini, Dragwyb feedback) with the exact data sent, when it is sent, and links to each provider's privacy policy and terms — exactly what a wp.org reviewer looks for in a plugin that transmits content off-site.
• The deactivation feedback form makes diagnostics sharing explicitly opt-in via a user-ticked checkbox (`share_diagnostics`) rather than silently attaching environment data, and the AJAX handler is nonce-protected (`ts_send_feedback_nonce`).
• Feedback submission is never a dead end: the 'Skip' button and the failure path both fall through to the original deactivation link, so a broken endpoint cannot trap a user in the modal.
• No bundled third-party JavaScript or CSS — the plugin consumes WordPress core globals (wp.blocks, wp.data, wp.richText, jQuery) instead of shipping its own copies, eliminating autoloader/namespace conflicts and bundled-library CVE exposure.
• Defensive capability checks before using unstable editor APIs: `window.wp.richText.RichTextData` and `wp.data.__unstableIsEditorReady` are probed for existence before use, and `resetBlocks` falls back to `resetEditorBlocks` on older WordPress versions.
• The AI provider runner implements AbortController cancellation, per-batch failure isolation (a failed batch still emits per-item 'AI Failed' results so the progress UI stays accurate), and stops the queue on quota/401 errors instead of hammering the API.
• buildTranslateSenseAiReasonHtml() consistently routes dynamic values (error text, origin, URLs) through an escapeHtml() helper before interpolation into HTML guidance strings, and copy targets are HTML-attribute escaped.
• The feedback form CSS respects `prefers-reduced-motion`, uses `:focus-visible` outlines, and swaps the spinner for a state class rather than colour alone — small but deliberate accessibility hygiene.
• Stable tag (0.1.0) and the top changelog entry (0.1.0) are in sync, and the readme license header correctly declares GPLv2-or-later with a matching License URI.
• The deactivation feedback form uses native `<button>` elements for close, skip, and submit actions, preserving default keyboard behavior.
• The close button includes `aria-label="Close feedback form"`, giving it an accessible name even though its visible content is an icon.
• The feedback error message uses both `role="alert"` and `aria-live="polite"`, providing a live announcement mechanism for validation feedback.
• Custom radio and checkbox visual elements are marked `aria-hidden="true"`, avoiding duplicate or meaningless announcements from styled control replacements.
• The diagnostics checkbox is associated with a wrapping `<label for="ts-share-diagnostics">` that includes explanatory text.
• Language flag images in the editor meta box include `alt` text derived from the language name.
• The Polylang requirement notice uses standard WordPress admin notice classes (`notice notice-warning is-dismissible`) and escaped translatable text.
• The quick Bulk Translate control uses a native `<button type="button">` with visible text, so it is keyboard-operable by default and does not require custom key handlers.
• The provided PHP does not render frontend forms, images, video, audio, or shortcode output that would introduce label, alt text, caption, or media accessibility failures.
• The content parser extracts `alt`, `title`, `aria-label`, `aria-description`, and `placeholder` attributes as translatable strings, which supports multilingual accessibility when those strings are translated appropriately.
• The bulk modal is mounted through an empty `div` and built by a React bundle that was not included in the audit set; the PHP itself does not render inaccessible modal controls.
• The audited files are backend/service-layer PHP classes and do not render custom shortcodes, blocks, forms, modals, tabs, menus, or JavaScript widgets.
• The only admin-facing behavior found is registration of a Custom Post Type using WordPress core admin UI, which provides native accessible controls and labels.
• The cron schedule label uses esc_html__() for translatable output.
• The Polylang synchronizer includes logic to update image alt attributes from translated attachment metadata when available, and rewrites src/srcset/alt attributes with esc_url()/esc_attr().
• No custom ARIA widgets, focusable div/span controls, unlabeled inputs, color-only indicators, animations, or media embeds are present in the audited code.
• Every REST route registers an explicit, individually auditable permission_callback, and require_edit_post()/require_manage_options() helpers fail closed with translated WP_Error messages.
• API keys are masked with a bullet-character mask in get_settings() and update_settings(), and redact_sensitive_values() recursively blanks token/secret keys before they reach the REST response — good handling of sensitive data in an API consumed by the admin UI.
• Output is returned as structured JSON via rest_ensure_response() rather than echoed HTML, eliminating XSS and accidental markup-injection surfaces in these endpoints.
• Classic_Builder escapes attribute-type replacements with htmlspecialchars(ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') and sorts offset replacements descending, avoiding offset drift and quote-breaking in attributes such as alt and title.
• Base_Builder adds CSS properties through a filtered 'translatesense_allowed_css_properties' allow-list rather than unconditionally disabling kses, keeping the safe_style_css filter narrow in scope.
• Translate::sanitize_string() (includes/translation/class-translate.php) reconstructs HTML by re-emitting the source tag tokens and only substituting sanitized text nodes, so AI output cannot strip or alter attributes such as alt, aria-label, role or tabindex from the original markup — a strong safeguard for preserving accessibility semantics through translation.
• Gutenberg_Builder::translate_inner_content_with_xpath() explicitly avoids serializing the DOMDocument working copy back into the Gutenberg fragment and patches only the matched source substring, which prevents parser-generated markup damage (e.g. dropped attributes or malformed tags) that would otherwise break structure for assistive technology.
• Reference_Replacer (internal-links/class-reference-replacer.php) rewrites <img> src and srcset while leaving all other attributes — including alt — untouched, so media URL localisation does not drop text alternatives.
• URL_Resolver::decode_url() decodes percent-encoded Unicode path segments so translated links remain human-readable rather than %xx sequences, which benefits users of text-to-speech and screen magnifiers reading link targets.
• Media_Reference_Translator never auto-creates attachment translations and returns clean nulls with negative caching, avoiding duplicate or empty media output that would produce images without meaningful alternatives.
• All five PHP files are backend XML-configuration code (wpml-config builders, rule resolver, XML engine, uninstall) and emit no user-facing HTML, so there is no risk of div-soup shortcodes, unordered headings or unlabelled form fields originating from them.
• XML generation consistently escapes/validates input: `validate_xml()` and `simplexml_load_string(..., LIBXML_NONET)` are used together with explicit `<!DOCTYPE` rejection, and Gutenberg `<xpath>` values pass through `htmlspecialchars()`.
• Translation status in the bulk UI is not conveyed by colour alone — `.ts-row-status.completed/.failed/.pending/.translating` all pair a background colour with a text label and a Dashicons glyph, satisfying 1.4.1 Use of Color.
• Interactive controls in the CSS are styled real elements where it matters: close buttons, retry/view/edit actions and the error-detail control are declared as `button` selectors rather than clickable `div`s, so they inherit native keyboard activation.
• Search fields and clear buttons keep or replace their focus indication (`.ts-bulk-search-input:focus` and `.ts-search-input-field:focus` supply a border + box-shadow instead of a bare outline removal).
• Modal dialogs use the correct role="dialog" plus aria-modal="true" and implement Escape-to-close with listener cleanup, preventing a keyboard trap.
• The modal close control is a native `<button type="button">` with `aria-label="Close modal"` and a matching `title`, so it is both keyboard operable and named.
• All decorative inline SVGs (globe, sparkle, search, check, language icons) carry `aria-hidden="true"`, and decorative flag/logo images use `alt=""`, keeping the accessibility tree free of noise.
• Every interactive element built in the shared primitives (component n: buttons, footer actions, confirm dialog actions) is a native `<button>` with an explicit `type`, so Enter/Space activation works by default and `disabled` is used rather than CSS-only disabling.
• Loading buttons render `aria-hidden="true"` on the spinner, avoiding spurious announcements of the indicator itself.
• The batch switcher uses a properly associated `<label htmlFor="ts-batch-select">` paired with `<select id="ts-batch-select">`.
• The 'Only show untranslated or failed items' filter uses a native checkbox nested inside its `<label>`, giving it an implicit accessible name and full keyboard support.
• Status indicators pair color with a text label and a dashicon (e.g. 'Completed', 'Failed', 'Skipped'), so colour is not the sole carrier of meaning (WCAG 1.4.1).
• The view switcher and step cards in the CSS include explicit `:focus-visible` treatments (`.ts-method-card:focus-visible`, `.ts-modern-switch input:focus-visible+.ts-modern-slider`), showing a focus-indicator pattern already established in the codebase.
• Actions use native <button> elements, which are keyboard accessible by default.
• Images include alt attributes, including provider logos, footer logo and Dragwyb plugin thumbnails.
• Close buttons for notices and modals have aria-label="Close".
• The translation-method selector uses role="radiogroup", role="radio", aria-checked, roving tabIndex and Arrow/Home/End keyboard handling — a solid ARIA radio pattern.
• The dashboard sidebar and tab navigation use semantic <aside> and <nav> elements with aria-label attributes.
• Tables use proper <table>, <thead>, <th> and <tbody> structure for the widget list view.
• The guide panel uses role="region" with aria-labelledby and tabIndex for keyboard focus.
• includes/admin/feedback/assets/css/ts-feedback-form.css:830-846 ships a real `@media (prefers-reduced-motion: reduce)` block neutralising transitions and animations for the modal, reason cards, submit button and spinner — partial coverage, but the intent and infrastructure are present.
• Focus indicators are provided for every interactive surface in the feedback modal: `.ts-deactivate-close:focus-visible` (2px solid #2271b1 with offset), `.ts-button-feedback:focus-visible`, `.ts-reason:has(input:focus-visible)` and `.ts-diagnostics-label input:focus-visible + .ts-checkbox-ui` — no interactive control relies on a removed outline without replacement.
• The textarea uses `outline: none` but immediately substitutes `border-color: #2271b1` plus a `box-shadow` ring on `:focus`, satisfying 2.4.7 rather than breaking it.
• Custom radio and checkbox controls hide the native input with `opacity: 0; position: absolute; width: 1px; height: 1px;` (CSS 212-230, 400-415) rather than `display: none`, keeping them in the accessibility tree and preserving native semantics and space/arrow-key behaviour.
• Escape key handling is implemented for the feedback modal via a namespaced delegated handler (`keydown.tsFeedback`), so the dialog is not a keyboard trap.
• Focus is moved into the dialog on open (`this.reasonInputs.first().trigger('focus')`), which is the correct first step of modal focus management.
• All values interpolated into the Chrome AI guidance HTML pass through a dedicated `escapeHtml()` helper before insertion, preventing markup injection into a region that assistive technology will read aloud.
• State highlighting for the selected reason is not colour-only — the checked state also flips the radio glyph fill, adds a border, background and a focus ring, satisfying 1.4.1 Use of Color for this component.
• Gutenberg translation success is surfaced through WordPress core's `core/notices` `createSuccessNotice(..., { type: 'snackbar', isDismissible: true })`, which inherits core's implemented `role="status"`/`aria-live` behaviour instead of a bespoke, inaccessible notification.
• The editor-layer modules (gutenberg.js, block-editor.js, meta-fields.js, index.js) mutate data stores and block attributes only and emit no user-facing markup, keeping the accessibility surface small and centralised in one modal and one guidance fragment.
• `_navigation_markup`-style semantic wrappers are not bypassed anywhere in this plugin — the audit found no heading hierarchy, landmark, tab or combobox patterns authored by the plugin itself in the supplied files.