Try escaping the comma with a '\' or using a CDATA section (I had some escaping issues noted on mailing list):
<bundle><![CDATA[
wrap:mvn:org.springframework/ldap/1.3.0.RELEASE,mvn:com.mycompany.stuff/stuff-common-security/1.0-SNAPSHOT/bnd/spring-ldap
]]></bundle>
If that doesn't work - I'd suspect the plugin is not using actual URL handlers and is just stripping off the wrap
protocol, so would suggest filing a bug
As you're using classifiers you might want to just do the embed in the pom for stuff-common-security
but that might make your build a bit too hairy =]
If so create a maven module with only those two modules as dependencies then use the BND/maven-bundle-plugin's embed dependencies to merge them.