None of the Wordpress plugins above protect you at all from firesheep or session hijacking at all, and yes SSL is the only way that you can be relatively assured that your connection is secure and also that you are talking to the site that you think you are. SSL validates the identity of the server as well as encrypting the connection.

However, trusting the router to deliver you to the right server is a bit easier than trusting everyone on your public network not to be snooping your session to hijack it, and once it's hijacked, they can easily enough change your password to lock you out! If you don't have SSL, at the least, you can create a user with limited privileges so that you can post to your website from a public place - just remember to change the owner of the post later to something that this username can't trash. Then, worst case, some mean snooper could flood your site with nasty posts and deface it a bit, but without actually damaging anything existing there. And they can't lock you out of your admin account.

Don't ever use an admin account on a public network *even with SSL* as it too can be cracked with enough work and enough packets going back and forth.