I got a notification this plugin has a vulnerability

Yes, same for me.
And now it is not on WordPress anymore. At least for now.
Does anyone who reads this what to do?
As if I will be deactivating the plugin, my internal site structure falls apart.

There is an update, but the security issue still there, so the only way is to use another plugin.
I switched to Easy Table of Contents, it will take a little of work to adapt, especially if you have a lot of pages-posts as you need to set it up and update every post that includes a TOC, but it is worth the effort.