If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties?
Are cookies only at risk during login, or am I at risk any time I use HTTP?
No. Outsiders can crack WEP networks almost as if they weren't encrypted at all, these days. Insiders have even more ease of access. Even on WPA/WPA2 networks, there are still exploits that enable insiders to sniff the traffic of others on the network. Lastly, there's always the risk of someone listening in on the wired side of the network where your data is not protected by the encryption used over the air.
Your data is at risk any time it is sent in the clear. Even if the login page itself is HTTPS, other webpages that transfer your session cookie over HTTP can put that account at risk. You are vulnerable as long as you remain logged in and the website is transferring your data un-encrypted.
The only effective way to protect your session cookies is to only use websites that transfer all data over HTTPS all the time, or use a VPN for everything. Even then, the VPN is only as trustworthy as the VPN service provider. There's also MITM attacks against HTTPS, so you've really got to trust the system and network you're on if that's your only protection.
no on the other side of the wifi base-station (the ethernet backbone) there could be a sniffer, WEP is only on the link from client to base-station
cookies get sent each time you send a request to the server that set the cookies so yes they are at risk