Shumway can be used as a runtime for those movies - the site owner just to need fallback to its HTML player. It plays common ActionScript 1/2/3 usages well.
There are not exploitable (at least not the same way). Firefox PDF viewer is a modification of PDF.js, so PDF.js code would run in the browser without a web server. The exploit might poke a hole in EMBED tag security of the web browser (and not in the PDF.js code itself). WP plugin shall be safe as any web application (unless it introduces similar security hole in its code, e.g. XSS).
Original PDF - 1.0M, SVGs - 7.7M, gzip'ed SVGs - 1.7M. I think the latter is a preferable format for the web, so you are looking 70% increase for this types of documents, but bare in mind that you may send only certain pages.
Oh, thanks. Sorry, I've just notice the CSS style for web browsers. So I should ask what is the use case for the web? Replacing PDF files for embedding without special viewers? And to add some custom styles if we want? seems great.
Just a hint: "pdfjs.disabled" is hard switch off and it makes it harder to recover native PDF plugin viewing capability. Switching using Preferences/Options->Applications makes it easier. Try it and stop complaining that you don't have a choice :)
