All web traffic that is not encrypted is vulnerable to having its contents altered enroute.

This is a type of man in the middle vulnerability that allows for javascript, posts, etc. to be changed into something malicious.