Question: I currently run several Wordpress MU installations.

My users are asking for the ability to post video (not just Youtube, but from our own Flash Media Server).

By default, Wordpress strips out `<embed>` tags.

Now, I would never allow users to include PHP or JavaScript in their posts, do I have to worry about Flash vulnerabilities?

How dangerous is the embed tag and should I worry about giving them the ability? 

Thanks

Answer: 
Generally speaking, Flash has come a long way in terms of preventing exploits like key trapping, etc.

The safest thing you could do would be to obfuscate the embedding code and have them only supply a SWF URL, that way they couldn't pull anything fancy in the embed object like allowing cross scripting, etc...

In particular, you want to watch out for things like potential hackers trying to call JS functions from your blog JS files by using AS3's `ExternalInterface.call()` function... that would definitely be bad. However I think you can use embed techniques to turn this off.
Make sure you set `allowScriptAccess="never"` in the object/embed tag to deny [scripting powers](http://kb2.adobe.com/cps/164/tn_16494.html) to third party SWFs.