The plugin’s default configuration (after pressing “Save Changes” on the settings page) allows unauthenticated users to “like” posts. It fetches the user’s IP like this:

        function wp_ulike_get_real_ip() {
                if (getenv('HTTP_CLIENT_IP')) {
                        $ip = getenv('HTTP_CLIENT_IP');
                } elseif (getenv('HTTP_X_FORWARDED_FOR')) {
                        $ip = getenv('HTTP_X_FORWARDED_FOR');
                } elseif (getenv('HTTP_X_FORWARDED')) {
                        $ip = getenv('HTTP_X_FORWARDED');
                } elseif (getenv('HTTP_FORWARDED_FOR')) {
                        $ip = getenv('HTTP_FORWARDED_FOR');
                } elseif (getenv('HTTP_FORWARDED')) {
                        $ip = getenv('HTTP_FORWARDED');
                } else {
                        $ip = $_SERVER['REMOTE_ADDR'];
                }

                return $ip;
        }

This will be incorrect in many situations. The header (which could be an IP address, or it could be an arbitrary string provided by the user) is stored in the database. Then it’s displayed to the admin without being escaped.

Current state: Fixed