Virtual machines make no difference here.
Assuming the owner/admin of the wifi access point is a average person, and not the NSA:
If the admin is reading the traffic passing his AP, but not doing anything else, HTTPS connections that are properly configured by the website owners are secure (sadly, as lay person, judging the configuration quality is not possible).
HTTP connections are fully readable by the admin.
If the admin starts to modify traffic passing the AP, as before HTTP connections are not protected from anything. This holds in both directions, ie. what you get from the webserver could be faked, and what the webserver gets from you too.
About HTTPS, pay attention to certificate warnings (instead of clicking the away, if the browser allows it). A warning is no proof for maicious activity, but nonetheless, don't proceed.
Thhird point, stop thinking that your wifi traffic is everything. Being connected to some network controlled by an attacker is very helpful to take over your computer completely...