Add create custom profile fields, unless your editing the profile with custom fields as an administrator, it will cause the Possible attack.