When you use an unsecured Wifi access point, your packets are sent in the clear. This means anyone who can set their Wifi card into monitoring mode can sniff and capture all traffic (that means ALL traffic from EVERYONE on the Wifi access point) that passes through that Wifi access point. The software to do this requires some technical prowess, and you need a Wifi adapter that supports monitoring mode, but isn't super difficult.
When you use a secured Wifi access point, your packets are encrypted. WEP is super easy to break using tools. WPA is possible to break, and WPA2 is hard to break (must be brute forced AFAIK). So no one who is not on the Wifi network can sniff and capture traffic.
If you use a VPN, or access a site via HTTPS, the transmission between you and the site is encrypted. If you do this on an unsecured wireless network, someone who may be capturing traffic will only see ciphertext. If they know anything about the keys, passwords, or certificates involved, they may be able to later decrypt the traffic. Decrypting a capture of such traffic is involved and difficult, and could be practically impossible if you are using a VPN with strong encryption and good enough passwords or private keys.
Now it is possible to run software on a Wifi access point, or on a device immediately after the access point but before the router it uses for Internet connectivity, to capture all traffic that has come in "after" the wireless network. Wireless encryption cannot prevent this. This is moderate to difficult but I doubt most people at most public Wifi spots would be capturing and analyzing traffic, but it is certainly possible.
However, if you are using a VPN or accessing sites via HTTPS, you are protected in the same way from this as described above.