Xprofile Custom Field Types (<= 1.3.1)

The BuddyPress Xprofile Custom Field Types plugin (versions <= 1.3.1) contains a Subscriber PHP Object Injection vulnerability.