Security exploits usually result in a security update. Generally speaking, these fix only the security problem(s) and include no new features that might break existing functionality unless somehow directly related to the exploit.
So if anything breaks as a result of a security update, then in theory it's because it would have exposed the system to the exploit being fixed in the first place and you'd want to also update the relevant plugin/template/whatever at the same time. In theory(again) the people responsible for that plugin either pay attention to such things or have been notified and will have fixed their code accordingly, in concert with the core application so that your upgrade goes smoothly.
If not, that's why you should have a development/test server, as Anonymous pointed out, so that you can test these things before pushing them live. If things like uptime are important to you, you should be doing this for any update to your sites anyway.
Worst case scenario, if the project for whatever reason doesn't do a security-only upgrade, you might end up needing to figure out what in the release deals with just the exploit and do some degree of manual patching or whatever, but this is relatively uncommon. (Again, your vagueness makes this hard to address.)