A vulnerability is a bug in software (core, plugin, theme) that can be exploited for an attack. Publicly known vulnerabilities have a CVE identifier (e.g. CVE-2024-12345). CVSS is a severity scale from 0 to 10; from 9.0 up it is a critical flaw.
It is solved by updating to a version that fixes the bug. If a fix does not exist yet, it helps to disable or replace the plugin.