If you’re following the rules (you never want to start out by breaking them), then any WordPress plug-in you write and submit to the repository must be licensed as GPLv2. There was a huge storm of discussion over this last year because the example readme file mistakenly said “GPL, version 2 or any later version” … which is why some plug-ins went the GPLv3 route.

Once it was pointed out that plug-ins had to be licensed using version 2 to be in compliance with the license of WordPress core, many plug-ins relicensed to version 2 and several that refused were removed from the repository. Unfortunately, quite a few flew under the radar and missed the update.

My suggestion would be to:

1. Contact the developers of Topsy and ask them to either relicense the plug-in or give you explicit permission to use some of their code and license your release under GPLv2
2. Wait until getting affirmation from Topsy before using any of their code in your own system.

Technically, Topsy is in violation of WordPress’ core license, and it’s the WordPress Foundation’s responsibility to pursue that (not yours). However, to make sure that you keep your own code in compliance and avoid any legal fallout should they pursue action against Topsy, you should either get permission to use the code in an appropriate manner or find something else to work with.

Update

After considerable discussion via email, in forums, on IRC, and on Trac, the core team clarified that any plugins hosted in the WP repository must be licensed as compatible with GPLv2. This means, for the most part, your plugins should either be explicitly GPLv2 or GPLv2+ (“or any later version”).

This is to prevent the possibility of accidentally rolling plugin code into core. Core is explicitly licensed as GPLv2+, so any code that is rolled in to the project must be capable of being licensed in the same way.

However, you can still license your privately-hosted plugins as GPLv3. This is still compatible with the “or any later version” stipulations of core while remaining separate (since it’s not hosted in the same location).