A theoretical attack is an attack strategy that was born out of “theory”, “calculation”, and — in the least cases — “simulation”. Yet, the strategy is yet to be proven in practice.
An actual attack which is practically proven and can be replicated is actual proof that a theoretical attack works. Therefore, the first is an indication of a weakness, while an actual attack is proof that that weakness actually exists.
It's actually not so much different from every regular science project. A theory is just a theory until someone can prove the theory is correct... transforming the theory into a fact.
In your SHA examples, SHA-0 is practically proven to have a weakness and - depending on available resources available for the attack - that weakness translates into "it's broken".
SHA-1 on the other hand shows that - in theory - it's broken too. But no one managed (or took the time) to actually put the theory in practice to prove it's indeed broken.
Personally, I regard "theoretical attack vectors and/or strategies" as a warning, while I regard "practically broken" as a red alert. After all, a theory could have some flaw rendering it void, but if someone has practically broken something, statistical chances that others will do the same rise every second.