Index: /CKEditor/trunk/CHANGES.html
===================================================================
--- /CKEditor/trunk/CHANGES.html	(revision 4523)
+++ /CKEditor/trunk/CHANGES.html	(revision 4524)
@@ -71,4 +71,5 @@
 		<li><a href="http://dev.fckeditor.net/ticket/4185">#4185</a> : Fixed resize handler effect doesn't affect flash object on output.</li>
 		<li><a href="http://dev.fckeditor.net/ticket/4196">#4196</a> : Fixed 'Remove Numbered/Bulleted List' on nested list doesn't work well on nested list.</li>
+		<li><a href="http://dev.fckeditor.net/ticket/4200">#4200</a> : Fixed unable to insert 'password' type filed with attributes.</li>
 	<h3>
 		CKEditor 3.0.1</h3>
Index: /CKEditor/trunk/_source/plugins/forms/dialogs/textfield.js
===================================================================
--- /CKEditor/trunk/_source/plugins/forms/dialogs/textfield.js	(revision 4523)
+++ /CKEditor/trunk/_source/plugins/forms/dialogs/textfield.js	(revision 4524)
@@ -180,5 +180,5 @@
 									replace.replace( element );
 									editor.getSelection().selectElement( replace );
-									data.element = element;
+									data.element = replace;
 								}
 							}