Three things an attacker can do
An attacker sitting on the network between your user and your server can do three things to plain HTTP. Read it, change it, and answer in your server's place.
TLS answers each by name. Encryption means the person sniffing the wifi sees only ciphertext. Every chunk carries a tag computed over its contents, so a single altered byte fails the check and the connection dies rather than handing over changed content. And the certificate means a machine pretending to be your bank cannot produce a key that traces back to a trusted authority.
Take those attackers as real rather than theoretical. Internet providers have injected content into plain pages, and hotel wifi gateways rewrite pages to add adverts. Any open wireless network lets a laptop nearby capture every unencrypted request in range.
Remember what the industry used to do. Until around 2012 most large sites encrypted the login page and then sent the session cookie in the clear. Hijacking somebody's account needed no password at all, only a packet capture.
What it does not cover
Be equally clear about what TLS does not cover, because that list is just as important.
It protects your data while it moves, not where it sits, so a breached database leaks plain text regardless. It does not hide who you talked to, since the address and usually the hostname stay visible to the network.
It does not vouch for anyone's intentions either, because a phishing domain gets a perfectly valid certificate in minutes for free. And it does nothing about your bugs, since an injection attack travels over TLS quite happily.
Take the accurate claim, narrow and strong as it is. With TLS, the network between two endpoints becomes untrusted plumbing you can safely run secrets through. Everything at the two ends is still your problem.
Worked example
In October 2010 Eric Butler released Firesheep, a Firefox extension that listened on open wifi and displayed one-click login buttons for every Facebook and Twitter session it overheard. The mechanics were mundane: those sites encrypted the password on the login page, then sent the session cookie over plain HTTP on every later request, so anyone on the same network could copy the cookie and become you. The extension passed 100,000 downloads in its first day, and journalists demonstrated it in cafes on strangers, with permission. The pressure worked. Facebook shipped opt-in HTTPS in January 2011 and made it the default by 2013, and Twitter went HTTPS-everywhere in 2012. Firesheep is why "HTTPS for the login page only" went from standard practice to a firing offense in about two years.