Buddypress Xprofile Custom Fields Type version 2.6.3 suffers from a remote code execution vulnerability.