Question: I currently run several Wordpress MU installations.

My users are asking for the ability to post video (not just Youtube, but from our own Flash Media Server).

By default, Wordpress strips out `<embed>` tags.

Now, I would never allow users to include PHP or JavaScript in their posts, do I have to worry about Flash vulnerabilities?

How dangerous is the embed tag and should I worry about giving them the ability? 

Thanks

Answer: 
Make sure you set `allowScriptAccess="never"` in the object/embed tag to deny [scripting powers](http://kb2.adobe.com/cps/164/tn_16494.html) to third party SWFs.
I would suggest that Flash is only as secure as the content it is presenting; and that including a Youtube video is no more or less dangerous than going to visit the same video on Youtube's website.