diff --git a/modules/color/color.module b/modules/color/color.module
index ff6c70e6cb7617f56ebc1c9674ab1575ac696b92..18954fe1fd3c21e5a7a32c635a52c16453d47d8a 100644
--- a/modules/color/color.module
+++ b/modules/color/color.module
@@ -42,6 +42,7 @@ function color_form_system_theme_settings_alter(&$form, &$form_state) {
       '#theme' => 'color_scheme_form',
     );
     $form['color'] += color_scheme_form($form, $form_state, $theme);
+    $form['#validate'][] = 'color_scheme_form_validate';
     $form['#submit'][] = 'color_scheme_form_submit';
   }
 }
@@ -270,6 +271,18 @@ function theme_color_scheme_form($variables) {
   return $output;
 }
 
+/**
+ * Validation handler for color change form.
+ */
+function color_scheme_form_validate($form, &$form_state) {
+  // Only accept hexadecimal CSS color strings to avoid XSS upon use.
+  foreach ($form_state['values']['palette'] as $key => $color) {
+    if (!preg_match('/^#([a-f0-9]{3}){1,2}$/iD', $color)) {
+      form_set_error('palette][' . $key, t('You must enter a valid hexadecimal color value for %name.', array('%name' => $form['color']['palette'][$key]['#title'])));
+    }
+  }
+}
+
 /**
  * Submit handler for color change form.
  */
diff --git a/modules/color/color.test b/modules/color/color.test
index 1ddfc0647daacb15502f5d815a7bd8d84ba0ccb6..897bd6cc01c5b7354ef938e1f4902f2719af42cb 100644
--- a/modules/color/color.test
+++ b/modules/color/color.test
@@ -11,6 +11,7 @@
 class ColorTestCase extends DrupalWebTestCase {
   protected $big_user;
   protected $themes;
+  protected $colorTests;
 
   public static function getInfo() {
     return array(
@@ -40,6 +41,19 @@ class ColorTestCase extends DrupalWebTestCase {
       ),
     );
     theme_enable(array_keys($this->themes));
+
+    // Array filled with valid and not valid color values
+    $this->colorTests = array(
+      '#000' => TRUE,
+      '#123456' => TRUE,
+      '#abcdef' => TRUE,
+      '#0' => FALSE,
+      '#00' => FALSE,
+      '#0000' => FALSE,
+      '#00000' => FALSE,
+      '123456' => FALSE,
+      '#00000g' => FALSE,
+    );
   }
 
   /**
@@ -93,4 +107,27 @@ class ColorTestCase extends DrupalWebTestCase {
     $this->assertTrue(strpos($stylesheet_content, 'public://') === FALSE, 'Make sure the color paths have been translated to local paths. (' . $theme . ')');
     variable_set('preprocess_css', 0);
   }
+
+  /**
+   * Test to see if the provided color is valid
+   */
+  function testValidColor() {
+    variable_set('theme_default', 'bartik');
+    $settings_path = 'admin/appearance/settings/bartik';
+
+    $this->drupalLogin($this->big_user);
+    $edit['scheme'] = '';
+
+    foreach ($this->colorTests as $color => $is_valid) {
+      $edit['palette[bg]'] = $color;
+      $this->drupalPost($settings_path, $edit, t('Save configuration'));
+
+      if($is_valid) {
+        $this->assertText('The configuration options have been saved.');
+      }
+      else {
+        $this->assertText('You must enter a valid hexadecimal color value for Main background.');
+      }
+    }
+  }
 }