Wifi (even with password) is usually set up as being security equivalent to an open wired network (plug in to network, you are presumed to supposed to be on it).
All communcation by any party on the network is fully visible. Security can be applied on top of the unsecured communication, but an open wired network has next to no security built-in (other than being able to physically connect to the wires).
Some wired networks packet switch, where only the packets you are supposed to see are sent to you. Wifi networks are not that secure, they are as only secure as the wired networks that send every packet to everyone (which is not very).
Other users on such a network can view easily, and modify with some difficulty, data you transfer over unencrypted protocols.
Now, on top of the network layer, you can have a secure layer; with good protocols, the insecurity of the network layer won't matter (that much -- the network layer could still deny service).
Communication over a secure protocol will thus remain private.
However, DNS lookups are not that private. DNSsec provides origin authentication of DNS data, but not confidentiality. So even over https, someone on your open wired network (or wireless-equivalent wifi) can tell what websites you are visiting. With https, they won't see what you are looking at, but they will know what websites.
Similar secure protocols exist for email and other services; often, the place you are connecting to is public, but what you communicate is private.
If you install something like Tor, or use a secure VPN, you can make the lack of privacy on your wifi not important.
I do not know the security state of facebook messages. But, presuming the engineers are competent (encryption/security is hard, so not guaranteed), it is probably roughly as secure as https, where the fact you are using facebook messages is public, but what and to whom you are sending it is not.
On top of the above, if they have access to your wifi, they could try some man-in-the-middle attacks; things like protocol degrading to an easier to break protocol. This is relatively advanced, can be mitigated by upgrading either the client (your web browser) or the server (to refuse to provide insecure protocol connections), and is not nearly as passive as what can be gathered over insecure connections.
The easy way to to mitigate this is to set up a guest wifi. With a poor configuration they might be able to do some mischief, but the level of sofistication goes from "relatively easy" (most of the above) to "it would be easier for them to hack your router".
There are wifi networks that provide "packet switching" (or better) levels of security (Like WPA2 Enterprise). You probably are not using one.