Release v1.47.0

accessibility-checker.php

@@ -10,7 +10,7 @@
  * Plugin Name:       Accessibility Checker
  * Plugin URI:        https://equalizedigital.com/accessibility-checker
  * Description:       Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.
- * Version:           1.46.0
+ * Version:           1.47.0
  * Requires PHP:      7.4
  * Author:            Equalize Digital
  * Author URI:        https://equalizedigital.com
@@ -36,7 +36,7 @@
 
 // Current plugin version.
 if ( ! defined( 'EDAC_VERSION' ) ) {
-	define( 'EDAC_VERSION', '1.46.0' );
+	define( 'EDAC_VERSION', '1.47.0' );
 }
 
 // Current database version.

admin/class-ajax.php

@@ -526,7 +526,15 @@ function ( $a, $b ) {
 								)
 							) . '" />';
 						} elseif ( $object_svg ) {
-							$html .= $object_svg;
+							// Rendered as an <img> via a data URI, not injected as inline markup -
+							// see edac_svg_markup_to_data_uri()'s docblock for why.
+							$html .= '<img src="' . esc_url( edac_svg_markup_to_data_uri( $object_svg ), [ 'data', 'http', 'https' ] ) . '" alt="' . esc_attr(
+								sprintf(
+									/* translators: %d: issue ID number */
+									__( 'image for issue %d', 'accessibility-checker' ),
+									$id
+								)
+							) . '" />';
 						}
 
 						$html .= '</div>';

admin/class-enqueue-admin.php

@@ -78,6 +78,11 @@ public static function maybe_enqueue_admin_and_editor_app_scripts() {
 
 			global $post;
 			$post_id = is_object( $post ) ? $post->ID : null;
+
+			// On a latest-posts homepage the global $post is the first blog post, not the page;
+			// let extensions supply the correct ID (e.g. a Pro virtual-page ID).
+			$post_id = apply_filters( 'edac_filter_admin_post_id', $post_id );
+
 			wp_enqueue_script( 'edac', plugin_dir_url( EDAC_PLUGIN_FILE ) . 'build/admin.bundle.js', [ 'jquery' ], EDAC_VERSION, false );
 			wp_set_script_translations( 'edac', 'accessibility-checker', plugin_dir_path( EDAC_PLUGIN_FILE ) . 'languages' );
 
@@ -99,8 +104,9 @@ public static function maybe_enqueue_admin_and_editor_app_scripts() {
 
 			if ( 'post.php' === $pagenow || 'post-new.php' === $pagenow ) {
 
-				// Is this posttype setup to be checked?
-				$active = $is_scannable_post;
+				// Base the scannable check on the filtered $post_id, not the original global $post.
+				$filtered_post_type = $post_id ? get_post_type( $post_id ) : false;
+				$active             = $filtered_post_type && is_array( $post_types ) && in_array( $filtered_post_type, $post_types, true );
 
 				$pro = defined( 'EDACP_VERSION' ) && EDAC_KEY_VALID;
 
@@ -113,8 +119,15 @@ public static function maybe_enqueue_admin_and_editor_app_scripts() {
 				wp_enqueue_script( 'edac-editor-app', plugin_dir_url( EDAC_PLUGIN_FILE ) . 'build/editorApp.bundle.js', false, EDAC_VERSION, false );
 				wp_set_script_translations( 'edac-editor-app', 'accessibility-checker', plugin_dir_path( EDAC_PLUGIN_FILE ) . 'languages' );
 
-				// If this is the frontpage or homepage, preview URLs won't work. Use the live URL.
-				if ( (int) get_option( 'page_on_front' ) === $post_id || (int) get_option( 'page_for_posts' ) === $post_id ) {
+				// Preview URLs don't work for the homepage. On a latest-posts homepage (including the
+				// show_on_front=page fallback with no static front page) use the live home URL instead.
+				$show_on_front        = get_option( 'show_on_front', 'posts' );
+				$is_latest_posts_home = ( 'posts' === $show_on_front || ( 'page' === $show_on_front && ! get_option( 'page_on_front' ) ) )
+					&& apply_filters( 'edac_filter_post_is_latest_posts_home', false, $post_id );
+
+				if ( $is_latest_posts_home ) {
+					$scan_url = add_query_arg( 'edac_pageScanner', 1, trailingslashit( get_home_url() ) );
+				} elseif ( (int) get_option( 'page_on_front' ) === $post_id || (int) get_option( 'page_for_posts' ) === $post_id ) {
 					$scan_url = add_query_arg( 'edac_pageScanner', 1, get_permalink( $post_id ) );
 				} else {
 					$post_view_link = apply_filters(

admin/class-helpers.php

@@ -139,54 +139,6 @@ public static function get_option_as_array( $option_name ) {
 		return [];
 	}
 
-
-	/**
-	 * Determine if a domain is hosted on a local loopback
-	 *
-	 * @param string $domain The domain to check.
-	 * @return boolean
-	 */
-	public static function is_domain_loopback( $domain ) {
-
-		// Check if this is an ipv4 address in the loopback range.
-
-		$record         = gethostbyname( $domain );
-		$loopback_start = ip2long( '127.0.0.0' );
-		$loopback_end   = ip2long( '127.255.255.255' );
-		$ip_long        = ip2long( $record );
-
-		if ( $ip_long >= $loopback_start && $ip_long <= $loopback_end ) {
-			return true;
-		}
-
-		// Check if this is an ipv6 loopback.
-
-		try {
-			$records = dns_get_record( $domain, DNS_AAAA );
-		} catch ( \Throwable $th ) {
-			return false;
-		}
-
-		foreach ( $records as $record ) {
-
-			// Do ipv6 check.
-			if ( isset( $record['type'] ) && 'AAAA' === $record['type'] ) {
-
-				// Normalize the IPv6 address for comparison.
-				$normalized_ipv6 = inet_pton( $record['ipv6'] );
-
-				// Normalize the loopback address.
-				$loopback_ipv6 = inet_pton( '::1' );
-
-				if ( $normalized_ipv6 === $loopback_ipv6 ) {
-					return true;
-				}
-			}
-		}
-
-		return false;
-	}
-
 	/**
 	 * Filter out inactive rules from the results returned.
 	 *

includes/classes/class-enqueue-frontend.php

@@ -102,7 +102,14 @@ public static function maybe_enqueue_frontend_highlighter() {
 
 		// Don't load on the frontend if we don't have a post to work with.
 		global $post;
-		$post_id = apply_filters( 'edac_filter_frontend_highlight_post_id', is_object( $post ) ? $post->ID : null );
+
+		// On a latest-posts homepage the global $post is the first blog post, so using its ID
+		// would misattribute results; pass null and let the filter supply an ID (Pro) or bail.
+		$default_post_id = ( is_home() && is_front_page() )
+			? null
+			: ( is_object( $post ) ? $post->ID : null );
+
+		$post_id = apply_filters( 'edac_filter_frontend_highlight_post_id', $default_post_id );
 
 		if ( null === $post_id ) {
 			return;

includes/helper-functions.php

@@ -248,10 +248,10 @@ function edac_get_post_type_label( string $post_type ): string {
  */
 function edac_get_valid_table_name( $table_name ) {
 	global $wpdb;
-	static $found_table_name;
+	static $found_table_names = [];
 
-	if ( isset( $found_table_name ) ) {
-		return $found_table_name;
+	if ( isset( $found_table_names[ $table_name ] ) ) {
+		return $found_table_names[ $table_name ];
 	}
 
 	// Check if table name only contains alphanumeric characters, underscores, or hyphens.
@@ -267,8 +267,8 @@ function edac_get_valid_table_name( $table_name ) {
 		return null;
 	}
 
-	$found_table_name = $table_name;
-	return $found_table_name;
+	$found_table_names[ $table_name ] = $table_name;
+	return $table_name;
 }
 
 /**
@@ -788,6 +788,27 @@ function edac_parse_html_for_media( $html ) {
 	];
 }
 
+/**
+ * Convert raw SVG markup into a data: URI, safe as an <img> src - browsers
+ * don't execute scripts or event handlers in SVGs loaded as images. Returns
+ * a bare (payload-less) data URI if given anything other than a string.
+ *
+ * @since 1.47.0
+ *
+ * @param mixed $svg_markup Raw SVG markup - expected to be a string.
+ * @return string Unescaped data URI - callers must esc_url() it before output,
+ *                passing a protocols list that includes 'data' (e.g.
+ *                esc_url( $uri, [ 'data', 'http', 'https' ] )); with the
+ *                default protocols esc_url() rejects data: URIs and returns ''.
+ */
+function edac_svg_markup_to_data_uri( $svg_markup ): string {
+	if ( ! is_string( $svg_markup ) ) {
+		return 'data:image/svg+xml,';
+	}
+
+	return 'data:image/svg+xml,' . rawurlencode( $svg_markup );
+}
+
 /**
  * Remove corrected posts
  *

package.json

@@ -1,6 +1,6 @@
 {
   "name": "accessibility-checker",
-  "version": "1.46.0",
+  "version": "1.47.0",
   "description": "Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.",
   "author": "Equalize Digital",
   "license": "GPL-2.0+",

readme.txt

@@ -1,9 +1,9 @@
 === Equalize Digital Accessibility Checker - WCAG, ADA, EAA and Section 508 compliance ===
 Contributors: equalizedigital, alh0319, stevejonesdev
 Tags: accessibility, EAA, WCAG, ADA, WP accessibility
-Requires at least: 6.7
+Requires at least: 6.8
 Tested up to: 7.0
-Stable tag: 1.46.0
+Stable tag: 1.47.0
 Requires PHP: 7.4
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html

src/frontendHighlighterApp/sass/app.scss

@@ -49,8 +49,9 @@ body {
 
 	&-element-selected {
 		outline: dashed 4px transparent !important;
-		outline-offset: 5px !important;
+		outline-offset: 2px !important;
 		outline-color: magenta !important;
+		box-shadow: 0 0 0 8px variables.$color-white !important;
 
 		&-min-width {
 			min-width: 25px !important;

src/pageScanner/checks/img-alt-empty-check.js

@@ -24,6 +24,11 @@ export default {
 			return true;
 		}
 
+		// Skip 1x1 tracking pixels (any src or base64)
+		if ( hasEmptyAlt && isTrackingPixel( node ) ) {
+			return true;
+		}
+
 		// Return false if alt is empty and none of the exceptions apply
 		return ! hasEmptyAlt;
 	},
@@ -84,6 +89,33 @@ function isInsideValidCaption( node ) {
 	return false;
 }
 
+/**
+ * Check if image is a 1x1 tracking pixel.
+ * Checks both HTML attributes and computed natural dimensions.
+ * @param {HTMLElement} node - The node to check
+ * @return {boolean} True if image is a 1x1 tracking pixel
+ */
+function isTrackingPixel( node ) {
+	// Check HTML width/height attributes
+	const widthAttr = node.getAttribute( 'width' );
+	const heightAttr = node.getAttribute( 'height' );
+	if ( widthAttr === '1' && heightAttr === '1' ) {
+		return true;
+	}
+
+	// Check computed natural dimensions (e.g. for base64 or loaded images without explicit attributes)
+	if (
+		typeof node.naturalWidth === 'number' &&
+		typeof node.naturalHeight === 'number' &&
+		node.naturalWidth === 1 &&
+		node.naturalHeight === 1
+	) {
+		return true;
+	}
+
+	return false;
+}
+
 /**
  * Check if image should be ignored due to plugin-specific cases
  * @param {HTMLElement} node - The node to check

src/pageScanner/checks/link-has-valid-href-or-role.js

@@ -50,21 +50,22 @@ export default {
 		}
 
 		const trimmedHref = href ? href.trim() : '';
+		const normalizedHref = trimmedHref.toLowerCase();
 
 		// Fail if href is missing, just '#', or contains invalid protocols
-		if ( ! href ||
+		if ( ! trimmedHref ||
 			trimmedHref === '#' ||
-			href.toLowerCase().startsWith( 'javascript:' ) ||
-			href.toLowerCase().startsWith( 'data:' ) ||
-			href.toLowerCase().startsWith( 'file:' )
+			normalizedHref.startsWith( 'javascript:' ) ||
+			normalizedHref.startsWith( 'data:' ) ||
+			normalizedHref.startsWith( 'file:' )
 		) {
 			return false;
 		}
 
 		// Optionally validate URL format if it's an absolute URL
-		if ( href.includes( '://' ) ) {
+		if ( trimmedHref.includes( '://' ) ) {
 			try {
-				new URL( href );
+				new URL( trimmedHref );
 			} catch ( e ) {
 				return false; // Invalid URL formats
 			}

src/sidebar/components/Panels/ReadabilityAnalysis.js

@@ -362,6 +362,8 @@ const ReadabilityAnalysis = () => {
 										{ __( 'Simplified Summary', 'accessibility-checker' ) }
 									</h4>
 									<TextareaControl
+										label={ __( 'Simplified Summary', 'accessibility-checker' ) }
+										hideLabelFromVision={ true }
 										value={ summaryText }
 										onChange={ setSummaryText }
 										placeholder={ __( 'Enter simplified summary...', 'accessibility-checker' ) }
@@ -403,6 +405,8 @@ const ReadabilityAnalysis = () => {
 								{ __( 'Simplified Summary', 'accessibility-checker' ) }
 							</h4>
 							<TextareaControl
+								label={ __( 'Simplified Summary', 'accessibility-checker' ) }
+								hideLabelFromVision={ true }
 								value={ summaryText }
 								onChange={ setSummaryText }
 								placeholder={ __( 'Enter simplified summary...', 'accessibility-checker' ) }

tests/jest/rules/imgAltEmpty.test.js

@@ -101,6 +101,28 @@ describe( 'Image Alt Empty Validation', () => {
 			shouldPass: true,
 		},
 
+		// Tracking pixel (1x1) edge cases
+		{
+			name: 'should pass for 1x1 tracking pixel with empty alt (gif)',
+			html: '<img src="track.gif" alt="" width="1" height="1">',
+			shouldPass: true,
+		},
+		{
+			name: 'should pass for 1x1 tracking pixel with empty alt (arbitrary src)',
+			html: '<img src="https://example.com/whatever.png" alt="" width="1" height="1">',
+			shouldPass: true,
+		},
+		{
+			name: 'should fail for 2x1 image with empty alt (not a tracking pixel)',
+			html: '<img src="tiny.png" alt="" width="2" height="1">',
+			shouldPass: false,
+		},
+		{
+			name: 'should fail for img with empty alt and no dimension attributes (cannot confirm tracking pixel without dimensions)',
+			html: '<img src="maybe-tracker.gif" alt="">',
+			shouldPass: false,
+		},
+
 		// Button context - image with empty alt inside button with accessible name
 		{
 			name: 'should pass for img with empty alt inside button with aria-label',

tests/jest/rules/linkImproper.test.js

@@ -39,6 +39,21 @@ describe( 'Link Improper Rule', () => {
 			html: '<a href="javascript:void(0)">Bad practice</a>',
 			shouldPass: false,
 		},
+		{
+			name: 'Fails when anchor has javascript: href with leading whitespace',
+			html: '<a href="  javascript:alert(1)">Bad practice</a>',
+			shouldPass: false,
+		},
+		{
+			name: 'Fails when anchor href contains only whitespace',
+			html: '<a href="   ">Whitespace link</a>',
+			shouldPass: false,
+		},
+		{
+			name: 'Fails when anchor href contains only whitespace',
+			html: '<a href="   ">Whitespace link</a>',
+			shouldPass: false,
+		},
 		{
 			name: 'Fails when anchor has malformed URL',
 			html: '<a href="http://example.com:invalid-port">Invalid URL</a>',