v1.18.0

Passes the official WordPress.org Plugin Check.

Fixes that matter on a live site

• Enlighter block labels were not translatable. The block editor's own strings were passed to __() through a loop variable, which the string extractor cannot see. Two of them — Code settings and the block description — had therefore never reached the Hebrew catalog and were showing in English on Hebrew sites. Rewritten as literal calls, and the two missing translations added.
• Page dropdowns in the Cookie Banner and Content Control settings screens escape their "no selection" label (wp_dropdown_pages() echoes, so it needs esc_html__()).
• WooCommerce Checkout: the block-checkout phone error is thrown as plain text. It is serialized into a JSON response, so escaping it there would have shown customers entities like ' — this also keeps the block and classic checkouts showing the same message.
• Tested up to raised to WordPress 7.0.

Hardening and clarity

Escaping moved to the point of output wherever that was free — the Cookie Banner texts tab (20 fields), the admin preview's inline style attributes, the banner class attribute, and the category icons. Where escaping is genuinely inapplicable it is now documented rather than implied: the banner's inline <style> block (a browser never decodes entities inside a style element, so escaping would break font stacks), the consent cookie (JSON), and REQUEST_URI in Hide Login and Content Control (parsed and compared, never printed).

Verification

origin/main at 1.17.0 reported 119 errors and 47 warnings across 23 files under the four sniffs Plugin Check runs. This build reports zero in plugin code. The official Plugin Check now returns a single warning, load_plugin_textdomain(), which is kept on purpose: core's guidance is to keep the call for plugins that support older WordPress or are not hosted on WordPress.org, and both apply here.

No behaviour changes beyond the fixes listed above.