When you install a plugin in WordPress you can choose to activate or deactivate it.
Let's say you have a plugin of which the latest version is vulnerable to XSS for example and you're waiting for a security fix to be released. Should I disable or uninstall the plugin? What is recommended?
A plugin is just a bunch of PHP (and other) files and when it's installed, it's in a directory on the web server so if a function is called from the outside by an attacker, it will get executed no matter if the plugin is "active" or not. A mitigation from a WAF or some htaccess rules to deny access might be used to block access to the vulnerable files until they are updated to the new (safe) version.
It is better to uninstall the plugin and delete all the files, unless it's not possible to do so because it would alter the website too much and you don't want to give up to some functions.