VB Security Patch for 3.5.4?

Hi,
I have been running a VB board for only a few months and saw where I need to upgrade or install a security patch. I dont wish to upgrade at the moment I just want to install the security patch with a plugin. I have downloaded the security patch to my desk top but not sure where to go from there.

Do I upload the plugin or do I go to the feature add new plug in. I think in the upload plug-in I saw where it says upload XML file. In the security patch there is an includes file and an attachment. From what I understand I just upload the attachment file is this correct? If so are any changes made to this or the includes file before uploading?

Thanks so much for any help I have asked at the community help board but No one has gotten back to me and its been several days now.

Jill