diff --git a/CHANGES.md b/CHANGES.md
index 4e67d00a..b0c5e7bd 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -14,6 +14,7 @@
 - [pull #705] XSS fixes in links, images, and more
 - [pull #720] Add `wiki-links` extra for `[[Page Name]]` style links (#221)
 - [pull #722] Harden URL safety checks and sanitization in safe mode (#721)
+- [pull #728] Fix XSS from zero-padded colon entities in link URLs (#726)
 
 
 ## python-markdown2 2.5.5
diff --git a/lib/markdown2.py b/lib/markdown2.py
index c912e635..5fa8cf58 100755
--- a/lib/markdown2.py
+++ b/lib/markdown2.py
@@ -1618,7 +1618,8 @@ def _safe_href(self):
         less_safe = r'#/\.!#$%&\(\)\+,/:;=\?@\[\]^`\{\}\|~'
         # html encoded colon in a URL still functions as a normal colon, so need to detect those
         # semicolon at the end is optional in browsers - see #721
-        protocol_seperators = [':', r':?', r':?', r':?']
+        # numeric references can be zero-padded (&#058, &#x003a) - see #726
+        protocol_seperators = [':', r'&#x0*3a;?', r'&#0*58;?', r':?']
         # dot seperated hostname, optional port number, not followed by protocol seperator
         domain = r'(?:[{}]+(?:\.[{}]+)*)(?:(?<!tel)(?<!javascript):\d+/?)?(?![^:/]*(?:{})/*)'.format(safe, safe, '|'.join(protocol_seperators))
         fragment = r'[%s]*' % (safe + less_safe)
diff --git a/test/tm-cases/xss_issue726.html b/test/tm-cases/xss_issue726.html
new file mode 100644
index 00000000..8b6acfe2
--- /dev/null
+++ b/test/tm-cases/xss_issue726.html
@@ -0,0 +1,7 @@
+<p><a href="#">Click me</a></p>
+
+<p><a href="#">Click me</a></p>
+
+<p><a href="#">Click me</a></p>
+
+<p><a href="#">Click me</a></p>
diff --git a/test/tm-cases/xss_issue726.opts b/test/tm-cases/xss_issue726.opts
new file mode 100644
index 00000000..54de31a8
--- /dev/null
+++ b/test/tm-cases/xss_issue726.opts
@@ -0,0 +1 @@
+{"safe_mode": "escape"}
\ No newline at end of file
diff --git a/test/tm-cases/xss_issue726.text b/test/tm-cases/xss_issue726.text
new file mode 100644
index 00000000..b276a169
--- /dev/null
+++ b/test/tm-cases/xss_issue726.text
@@ -0,0 +1,7 @@
+[Click me](javascript&#058alert(origin))
+
+[Click me](javascript&#0000058;alert(origin))
+
+[Click me](javascript&#x003a;alert(origin))
+
+[Click me](javascript&#X003A;alert(origin))