Wordpress - Confirmation box when submitting post for review

A useful fast way is to use JavaScript in combination with an Ajax action that outputs the box.

Create a small plugin. Create a folder inside plugins directory, naming it 'SubmitReviewConf'. In this folder create a PHP file named SubmitReviewConf.php.

In this file, put this code:

<?php
/**
* Plugin Name: Submit for Review Confirmation Message
* Description: Confirmation Message for Submit for Review Action
* Author: G.M.
*/

function add_my_admin_assets( $hook ) {
    // Only once variable force the box to be shown only one time. Can be from theme or plugin via filter.
    // Default is true
    $only_once = apply_filters( 'submit_review_conf_onlyonce', 1 );
    //
    if ( $only_once && $hook == 'post.php' ) $post = get_post( $_GET['post'] );
    $enqueue = $only_once ? ($hook == 'post-new.php' || ( $hook == 'post.php' && $post->post_status != 'pending') ) : ($hook == 'post-new.php' || $hook == 'post.php');
    if ( isset($post) && get_post_meta( $post->ID, '_skip_SubmitReviewConf', true ) ) return;
    $postid = '';
    if ( isset($_GET['post']) && is_object($post) ) $postid = $post->ID;
    if ( $enqueue && ! current_user_can( 'edit_published_posts' ) ) {
        wp_enqueue_style( 'thickbox' );
        wp_enqueue_script( 'SubmitReviewConf', plugins_url( 'SubmitReviewConf.js', __FILE__ ), array( 'jquery','thickbox' ), null );
        wp_localize_script( 'SubmitReviewConf', 'SubmitReviewConfData', array( 'only_once' => $only_once, 'postid' => $postid ) );
    } 
}
add_action( 'admin_enqueue_scripts', 'add_my_admin_assets', 30 );

function clean_up_SubmitReviewConf_meta( $post ) {
     delete_post_meta( $post->ID, '_skip_SubmitReviewConf' );
}
add_action( 'pending_to_publish', 'clean_up_SubmitReviewConf_meta', 30 );      

function confirmation_msg_out() {
    if ( isset( $_GET['only_once'] ) && isset( $_GET['postid'] ) ) update_post_meta( $_GET['postid'], '_skip_SubmitReviewConf', '1' );
    // SET HTML FOR THE CONFIRMATION MESSAGE IN THIS FUNCTION
    ?>
    <div id="confirmation_msg_out">
        <ul>
            <li><?php _e('Did you ... '); ?></li>
            <li><?php _e('Did you ... '); ?></li>
            <li><?php _e('Did you ... '); ?></li>
        </ul>
        <input id="confirmation_msg_submit" class="button button-primary button-large" value="<?php _e('Submit for Review') ?>" name="submitforreview"></input>
        <a id="confirmation_msg_submit_cancel" class="button button-large" href="#"><?php _e('Cancel') ?></a>
    </div>
    <?php
    die();
}
add_action( 'wp_ajax_output_review_confirm', 'confirmation_msg_out' );

This small plugin contains only 2 functions. ( Edit: after an OP request in comments, it became 3)

The first enqueues a custom script (what is it is explained later) and the 'thickbox' script (the script WordPress uses to show modal messages).

These scripts are enqueued only if current user cannot edit published posts, so authors and higher users can publish posts with no confirmation message.

The second function outputs the HTML for the confirmation box. This function is hooked into an Ajax action, output_review_confirm.

Now in the same folder of PHP files let's create our JavaScript file and name it SubmitReviewConf.js.

In this file put:

jQuery().ready( function($) {

    var $publish = $('#publish');

    var only_once = SubmitReviewConfData.only_once;

    function remove_confirm_publish_button() {
        $('#confirm-publish-button').remove();
        $publish.show();
    }

    $(document).on('click', '#confirm-publish-button', function(e) {
        e.preventDefault();
        if ( only_once ) remove_confirm_publish_button();
        var tb_show_url = ajaxurl + '?action=output_review_confirm';
        if (only_once) tb_show_url += "&only_once=1";
        if ( SubmitReviewConfData.postid != '' ) tb_show_url += "&postid=" + 
            SubmitReviewConfData.postid;
        tb_show('', tb_show_url);
    });

    $(document).on('click', '#confirmation_msg_submit', function(e) {
        e.preventDefault();
        tb_remove();
        $publish.click();
    });

    $(document).on('click', '#confirmation_msg_submit_cancel', function(e) {
        e.preventDefault();
        tb_remove();
    });

    var newbutton = '<input id="confirm-publish-button" class="button button-primary button-large" type="button" value="' + 
        $publish.val() + '"></input>';
    $publish.hide().after(newbutton);

});

What this script does:

1. Hides the WordPress 'Submit for Review' button and replaces it with a button that appears equal to the WP one, but that does not trigger the submit action.
2. When our fake submit button is clicked, we use the Ajax URL to trigger our function and output the HTML inside the modal confirmation, using the tb_show function provided by the ThickBox script.
3. When the user clicks 'Submit for Review' inside the modal box, we simulate a click on the WP standard 'Submit for Review' button and remove the modal window. If the user clicks on 'Cancel' we simply remove the modal window, doing nothing.

That's all. Remember to activate the plugin in WP backend ;)

Note that this plugin requires JavaScript to be enabled on user browser. If disabled the user will not see any confirmation, but consider that modal window (ThickBox) is a JavaScript script that cannot work if JavaScript is disabled.

If this feature was a critical one, you'd probably want to disable publishing if JavaScript is disabled, but being a not-critical feature, you can just ignore users that have JavaScript disabled (WordPress will take care for your security, in that case) considering they are a very small percentage of users.