Cpe:2.3:a:buddypress:xprofile_custom_field_types:*:*:*:*:*:*:*:*

The BuddyPress Xprofile Custom Field Types plugin (versions <= 1.3.1) contains a Subscriber PHP Object Injection vulnerability.